CVE-2022-2542

CVE-2022-2542 describes a Cross-Site Request Forgery (CSRF) to Cross-Site Scripting (XSS) vulnerability in the uContext for Clickbank plugin for WordPress, affecting versions up to and including 3.9.1. This flaw stems from a lack of nonce validation in the plugin's AJAX handling, allowing unauthenticated attackers to inject malicious scripts. The vulnerability carries a CVSS score of 8.8 (High), indicating a critical risk where an attacker could achieve high impact on confidentiality, integrity, and availability by tricking an administrator into clicking a malicious link. There is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.