CVE-2022-4974: 5starplugins Easy Age Verify

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

Affected products

  • 5starplugins Easy Age Verify: before 1.6.1 (fixed in 1.6.1)
  • 5starplugins Featured Images In Rss For Mailchimp & More: before 1.5.9 (fixed in 1.5.9)
  • 5starplugins Marijuana Age Verify: before 1.3.1 (fixed in 1.3.1)
  • 9brada6 Tabs With Recommended Posts Widget: version 0 only
  • Actuaryzask Azw Woocommerce File Uploads: version 0 only
  • Aguilerasoft Conversion De Moneda Woocommerce: version 0 only
  • Aharonyan Guest Posting / Frontend Posting / Front Editor – Wp Front User Submit: before 3.4.1 (fixed in 3.4.1)
  • AHMED17 CF7 Constant Contact Fields Mapping: version 0 only
  • AHMED17 Menu Item Scheduler: version 0 only
  • AHMED17 Rw Divi Unite Gallery: up to and including 1.0
  • Akdevs Genealogical Tree – Family Tree & Ancestry For WordPress: up to and including 2.1.5
  • Alekv Pixel Manager For Woocommerce – Conversion Tracking, Google Ads, GA4, Tiktok, Dynamic Remarketing: before 1.14.3 (fixed in 1.14.3)
  • Alex-Ye Bbresolutions: version 0 only
  • Alexmoss Opensea: before 1.0.3 (fixed in 1.0.3)
  • Alleythemes Alley Business Toolkit: before 1.1.8 (fixed in 1.1.8)
  • Alphabposervice Easy Code Snippets: before 1.0.1 (fixed in 1.0.1)
  • Alphabposervice Easy Math Captcha For CF7: version 0 only
  • Alphabposervice Easy Newsletter Signups: before 1.0.4 (fixed in 1.0.4)
  • Alphabposervice Easy Post Views Count: before 1.0.5 (fixed in 1.0.5)
  • Anasbinmukim Mailchimp Manager: version 0 only
  • Andyabelow Media Library File Download: before 1.1 (fixed in 1.1)
  • Anfrageformular Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung: version 0 only
  • Ankitmaru Advanced Page Visit Counter – Most Wanted Analytics Plugin For WordPress: before 6.0.0 (fixed in 6.0.0)
  • Annastaa Annasta Filters For Woocommerce: before 1.5.0 (fixed in 1.5.0)
  • Anssilaitila Contact List – Online Staff Directory & Address Book: before 2.9.50 (fixed in 2.9.50)
  • and 595 more

Published 2024-10-16. Last modified 2026-06-17.