{"containers": {"cna": {"affected": [{"product": "Easy Drag And drop All Import : WP Ultimate CSV Importer", "vendor": "Unknown", "versions": [{"lessThan": "6.4.3", "status": "affected", "version": "6.4.3", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Felipe de Avila"}], "descriptions": [{"lang": "en", "value": "The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-02-28T09:06:48", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://plugins.trac.wordpress.org/changeset/2662897"}], "source": {"discovery": "EXTERNAL"}, "title": "WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2022-0360", "STATE": "PUBLIC", "TITLE": "WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Easy Drag And drop All Import : WP Ultimate CSV Importer", "version": {"version_data": [{"version_affected": "<", "version_name": "6.4.3", "version_value": "6.4.3"}]}}]}, "vendor_name": "Unknown"}]}}, "credit": [{"lang": "eng", "value": "Felipe de Avila"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues"}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f", "refsource": "MISC", "url": "https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f"}, {"name": "https://plugins.trac.wordpress.org/changeset/2662897", "refsource": "CONFIRM", "url": "https://plugins.trac.wordpress.org/changeset/2662897"}]}, "source": {"discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2022-0360", "datePublished": "2022-02-28T09:06:48", "dateReserved": "2022-01-25T00:00:00", "dateUpdated": "2022-02-28T09:06:48", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:smackcoders:import_all_pages\\,_post_types\\,_products\\,_orders\\,_and_users_as_xml_\\&_csv:*:*:*:*:wordpress:*:*:*", "matchCriteriaId": "B7ABE294-3FB3-4189-9394-7B346C0B37C2", "versionEndExcluding": "6.4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues"}, {"lang": "es", "value": "El plugin Easy Drag And Drop All Import : WP Ultimate CSV Importer de WordPress versiones anteriores a 6.4.3, no sanea y escapa de los comentarios importados, lo que podr\u00eda permitir a usuarios con altos privilegios importar comentarios maliciosos (intencionadamente o no) y conllevar problemas de tipo Cross-Site Scripting Almacenado."}], "id": "CVE-2022-0360", "lastModified": "2023-06-07T02:43:44.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-02-28T09:15:09.043", "references": [{"source": "contact@wpscan.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://plugins.trac.wordpress.org/changeset/2662897"}, {"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "contact@wpscan.com", "type": "Primary"}]}

{}