CVE-2022-1937

MEDIUMNuclei

Awin Data Feed < 1.8 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-1937 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Awin Data Feed

CVE List1.8 to < 1.8affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Awin Data Feed <=1.6 - Cross-Site ScriptingCVSS 6.1

WordPress Awin Data Feed plugin 1.6 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action, available to both unauthenticated and authenticated users.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of the WordPress Awin Data Feed plugin (1.6 or higher) to mitigate this vulnerability.

WeaknessesCWE-79
AuthorsAkincibor, DhiyaneshDK
Template tagscvecve2022xssawinwpscanwp-pluginwpwordpressauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:awin:awin_data_feed:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/eb40ea5d-a463-4947-9a40-d55911ff50e9 https://nvd.nist.gov/vuln/detail/CVE-2022-1937 https://github.com/ARPSyndicate/kenzer-templates https://github.com/cyllective/CVEs

Source: ProjectDiscovery

References

2