WordPress Plugin Vulnerabilities

Bulk Delete Users by Email < 2.0.0 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
bulk-delete-users-by-email
Fixed in 2.0.0

References

CVE
CVE-2022-4267

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScan
Verified
Yes
WPVDB ID
e09754f2-e241-4bf8-8c95-a3fbc0ba7585

Timeline

Publicly Published
2022-12-02 (about 3 years ago)
Added
2022-12-02 (about 3 years ago)
Last Updated
2025-09-26 (about 3 months ago)

Other

Published
Title
Published
2025-09-10
Title
Elements Plus! < 2.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2025-09-15
Title
Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments
Published
2024-12-06
Title
코드엠샵 소셜톡 < 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-11-13
Title
SNORDIAN's H5PxAPIkatchu < 0.4.18 - Unauthenticated Stored Cross-Site Scripting via insert_data
Published
2021-05-17
Title
Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID