CVE-2022-0360

Опубликовано: 28 фев. 2022

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues

Ссылки

https://plugins.trac.wordpress.org/changeset/2662897
Release Notes
Third Party Advisory
https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f
Exploit
Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2662897
Release Notes
Third Party Advisory
https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv:*:*:*:*:wordpress:*:*:*

Версия до 6.4.3 (исключая)

EPSS

Процентиль: 43%

0.00206

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-xc3c-6399-cmgj