Medium severity · published May 2, 2022
CVE-2022-1255
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import…
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IA
Import And Export Users And Customers · Codection
before 1.19.2.1 · source: NVD
Affected product
IA
Import And Export Users And Customers
Codection
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-1255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-1255
Exploit
https://wpscan.com/vulnerability/22fe68c4-8f47-491e-be87-5e8e40535a82
More from Import And Export Users And Customers
8.0
CVE-2022-3558
Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection
8.0
CVE-2020-22277
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile
7.5
CVE-2024-38787
WordPress Import and export users and customers plugin <= 1.26.8 - Sensitive Information via Imported File vulnerability
7.2
CVE-2023-6583
Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality
6.5
CVE-2026-54862
WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability