The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues
References
| Link | Resource |
|---|---|
| https://plugins.trac.wordpress.org/changeset/2662897 | Release Notes Third Party Advisory |
| https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f | Exploit Third Party Advisory |
| https://plugins.trac.wordpress.org/changeset/2662897 | Release Notes Third Party Advisory |
| https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/changeset/2662897 - Release Notes, Third Party Advisory | |
| References | () https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f - Exploit, Third Party Advisory |
07 Jun 2023, 02:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv:*:*:*:*:wordpress:*:*:* | |
| First Time |
Smackcoders import All Pages\, Post Types\, Products\, Orders\, And Users As Xml \& Csv
|
Information
Published : 2022-02-28 09:15
Updated : 2024-11-21 06:38
NVD link : CVE-2022-0360
Mitre link : CVE-2022-0360
CVE.ORG link : CVE-2022-0360
JSON object : View
Products Affected
smackcoders
- import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')