CVE-2022-1255: Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site Scripting
Published May 2, 2022
·Updated
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
Affected Software
1 affected component
codection Import And Export Users And Customers Wordpress<1.19.2.1
Event History
May 2, 2022
CVE Published
via MITRE·04:05 PM
Data Sourced
via MITRE·04:05 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for the Import and export users and customers WordPress plugin?
The vulnerability ID is CVE-2022-1255.
2
What is the severity rating for CVE-2022-1255?
The severity rating for CVE-2022-1255 is medium with a score of 4.8.
3
What is the affected software for CVE-2022-1255?
The affected software for CVE-2022-1255 is the Import and export users and customers WordPress plugin version up to 1.19.2.1.
4
What is the impact of CVE-2022-1255?
CVE-2022-1255 allows high privilege users to import malicious javascript code, leading to Stored Cross-Site Scripting (XSS) issues.
5
Is there a fix available for CVE-2022-1255?
Yes, updating the Import and export users and customers WordPress plugin to version 1.19.2.1 or newer will fix the vulnerability.