CVE-2022-0360

The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues

CVSS v3.1

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.65% chance of exploitation in the next 30 days, 49th percentile

Published

2022-02-28

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f

References

• CVE Record
• NVD entry

Related

• CVE-2022-0359
• CVE-2022-0361
• CVE-2022-0352
• CVE-2022-0362
• CVE-2022-0351
• CVE-2022-0363