{"id":"CVE-2022-0360","state":"PUBLISHED","title":"WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting","description":"The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues","publishedAt":"2022-02-28T09:06:48.000Z","updatedAt":"2024-08-02T23:25:40.211Z","severity":null,"assigner":"WPScan","products":["Unknown Easy Drag And drop All Import : WP Ultimate CSV Importer"],"affected":[{"vendor":"Unknown","product":"Easy Drag And drop All Import : WP Ultimate CSV Importer","versions":[{"version":"6.4.3","status":"affected","lessThan":"6.4.3","versionType":"custom"}]}],"references":["https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f","https://plugins.trac.wordpress.org/changeset/2662897"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:49:26.075Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/0xxx/CVE-2022-0360.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-0360","state":"PUBLISHED","datePublished":"2022-02-28T09:06:48.000Z","dateUpdated":"2024-08-02T23:25:40.211Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2022-01-25T00:00:00.000Z"},"containers":{"cna":{"title":"WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting","descriptions":[{"lang":"en","value":"The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues"}],"affected":[{"vendor":"Unknown","product":"Easy Drag And drop All Import : WP Ultimate CSV Importer","versions":[{"version":"6.4.3","status":"affected","lessThan":"6.4.3","versionType":"custom"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f","tags":["x_refsource_MISC"]},{"url":"https://plugins.trac.wordpress.org/changeset/2662897","tags":["x_refsource_CONFIRM"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Cross-site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2022-02-28T09:06:48.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"Felipe de Avila"}],"source":{"discovery":"EXTERNAL"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2022-0360","STATE":"PUBLIC","TITLE":"WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Easy Drag And drop All Import : WP Ultimate CSV Importer","version":{"version_data":[{"version_affected":"<","version_name":"6.4.3","version_value":"6.4.3"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"Felipe de Avila"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues"}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f","refsource":"MISC","url":"https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f"},{"name":"https://plugins.trac.wordpress.org/changeset/2662897","refsource":"CONFIRM","url":"https://plugins.trac.wordpress.org/changeset/2662897"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://plugins.trac.wordpress.org/changeset/2662897","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T23:25:40.211Z"}}]}}}