CVE-2022-3805

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.

• CWE-639

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2811758%40jeg-elementor-kit%2Ftrunk&old=2810568%40jeg-elementor-kit%2Ftrunk&sfp_email=&sfph_mail=Exploit, Third Party Advisory
• https://wordpress.org/plugins/jeg-elementor-kit/#developersProduct, Release Notes, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2811758%40jeg-elementor-kit%2Ftrunk&old=2810568%40jeg-elementor-kit%2Ftrunk&sfp_email=&sfph_mail=Exploit, Third Party Advisory
• https://wordpress.org/plugins/jeg-elementor-kit/#developersProduct, Release Notes, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013Third Party Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38044Windows CD-ROM File System Driver Remote Code Execution Vuln…7.8
• CVE-2022-38045Windows Server Service Elevation of Privilege Vulnerability8.8
• CVE-2022-38046Web Account Manager Information Disclosure Vulnerability7.5
• CVE-2022-38047Windows Point-to-Point Tunneling Protocol Remote Code Execut…8.1
• CVE-2022-38048Microsoft Office Remote Code Execution Vulnerability7.8
• CVE-2022-38049Microsoft Office Graphics Remote Code Execution Vulnerabilit…7.8
• CVE-2022-38050Win32k Elevation of Privilege Vulnerability7.8
• CVE-2022-38051Windows Graphics Component Elevation of Privilege Vulnerabil…7.8
• CVE-2022-38053Microsoft SharePoint Server Remote Code Execution Vulnerabil…8.8
• CVE-2022-38054In Apache Airflow versions 2.2.4 through 2.3.3, the `databas…9.8
• CVE-2022-38055Improper Neutralization of Script-Related HTML Tags in a Web…5.4
• CVE-2022-38056Improper neutralization in the Intel(R) EMA software before …5.3