CVE-2022-2071

The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.33% chance of exploitation in the next 30 days, 25th percentile

Published

2022-07-25

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d3653976-9e0a-4f2b-87f7-26b5e7a74b9d

References

• CVE Record
• NVD entry

Related

• CVE-2022-20707
• CVE-2022-20713
• CVE-2022-20705
• CVE-2022-20718
• CVE-2022-2070
• CVE-2022-20719