CVE-2022-3847

The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS payloads via a CSRF attack

• https://bulletin.iese.de/post/get-site-to-phone-by-qr-code_0-0-1/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/a70ad549-2e09-44fb-b894-4271ad4a84f6Exploit, Third Party Advisory
• https://bulletin.iese.de/post/get-site-to-phone-by-qr-code_0-0-1/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/a70ad549-2e09-44fb-b894-4271ad4a84f6Exploit, Third Party Advisory

Published

Nov 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38463ServiceNow through San Diego Patch 4b and Patch 6 allows ref…6.1
• CVE-2022-38465A vulnerability has been identified in SIMATIC Drive Control…7.8
• CVE-2022-38466A vulnerability has been identified in CoreShield One-Way Ga…7.8
• CVE-2022-38467Reflected Cross-Site Scripting (XSS) vulnerability in CRM Pe…6.1
• CVE-2022-38468Cross-Site Request Forgery (CSRF) vulnerability in Imagely W…4.3
• CVE-2022-38469 An unauthorized user with network access and the decrypt…7.5
• CVE-2022-38470Cross-Site Request Forgery (CSRF) vulnerability in Customer …8.8
• CVE-2022-38472An attacker could have abused XSLT error handling to associa…6.5
• CVE-2022-38473A cross-origin iframe referencing an XSLT document would inh…8.8
• CVE-2022-38474A website that had permission to access the microphone could…4.3
• CVE-2022-38475An attacker could have written a value to the first element …6.5
• CVE-2022-38476A data race could occur in the <code>PK11_ChangePW</code> fu…7.5