CVE-2022-3149: WP Custom Cursors < 3.0.1 - Stored Cross-Site Scripting via CSRF

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-17 · updated 2026-06-17
Weakness: CWE-79

Description

The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin perform such actions via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping in some of the cursor options, it could also lead to Stored Cross-Site Scripting

Affected products

WP Custom Cursors | WordPress Cursor Plugin: before 3.0.1 — fixed in 3.0.1

How to fix

Upgrade to a fixed version: WP Custom Cursors | WordPress Cursor Plugin 3.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-3149 or the next vulnerability affects your stack