CVE-2022-1763: Static Page eXtended <= 2.1 - Arbitrary Settings Update via CSRF to Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-13 · updated 2026-06-17
Weakness: CWE-352

Description

Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings

Affected products

Static Page eXtended: through 2.1

References

https://wpscan.com/vulnerability/bd3aff73-078a-4e5a-b9e3-1604851c6df8
https://wpscan.com/vulnerability/bd3aff73-078a-4e5a-b9e3-1604851c6df8

Get alerted when CVE-2022-1763 or the next vulnerability affects your stack