What’s Vulnerable › Vulnerabilities

CVE-2022-2382: Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-08-22 · updated 2026-06-17
• Weakness: CWE-352

Description

The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.

Affected products

• Product Slider for WooCommerce: before 2.5.7 — fixed in 2.5.7

How to fix

Upgrade to a fixed version: Product Slider for WooCommerce 2.5.7. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/777d4637-444b-4eda-bc21-95d3a3bf6cd3
• https://wpscan.com/vulnerability/777d4637-444b-4eda-bc21-95d3a3bf6cd3

Get alerted when CVE-2022-2382 or the next vulnerability affects your stack