The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVSS 3.1MEDIUM 5.4·Network·Low privileges·User interaction·EPSS 0.00344·Published 2022-07-11·Fixed in 2.70CWE-352