CVE-2022-38075

The Mantenimiento web plugin for WordPress contains a Cross-Site Request Forgery vulnerability in versions up to 0.9 due to inadequate nonce validation in the vista_configuracion() function. An unauthenticated attacker could exploit this flaw by crafting a malicious request that, if clicked by a site administrator, would allow unauthorized modification of plugin settings and injection of malicious JavaScript code. The vulnerability was addressed in version 0.14 and later.

Based on public CVE data (MITRE/NVD).