WordPress Plugin Vulnerabilities

WP Smart Import < 1.0.3 - Reflected Cross-Ste Scripting

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Affects Plugins

Plugin icon
wp-smart-import
Fixed in 1.0.3

References

CVE
CVE-2022-40209

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Tien Nguyen Anh
Verified
No
WPVDB ID
247a213f-d824-4095-b6a3-a490e95964ba

Timeline

Publicly Published
2022-12-06 (about 1 years ago)
Added
2022-12-06 (about 1 years ago)
Last Updated
2022-12-06 (about 1 years ago)

Other

Published
Title
Published
2022-01-04
Title
Amazon Affiliate < 3.17.1 - Reflected Cross-Site Scripting
Published
2023-11-01
Title
ChatBot 4.8.6 - 4.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder
Published
2022-05-12
Title
WordPress Forms by Pie Forms < 1.4.9.4 - Admin+ Stored Cross-Site Scripting
Published
2024-03-15
Title
Elementor Addon Elements < 1.12.11 - Contributor+ Stored XSS
Published
2020-01-13
Title
Computer Repair Shop < 2.0 - Authenticated Stored XSS