CVE-2022-28290

MEDIUMNuclei

welaunch wordpress_country_selector Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2022-28290 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the HTTP request

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 16, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

WordPress Country Selector Plugin

CVE ListVersion 1.6.5affected

wordpress_country_selector

Browse welaunch / wordpress_country_selector
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Country Selector <1.6.6 - Cross-Site ScriptingCVSS 6.1

WordPress Country Selector plugin prior to 1.6.6 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the country and lang parameters before outputting them back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Update WordPress Country Selector plugin to version 1.6.6 or later to mitigate the vulnerability.

WeaknessesCWE-79
AuthorsAkincibor
Template tagscvecve2022wordpress-country-selectorwpscanwpwordpresswp-pluginxsswelaunchvulnvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:welaunch:wordpress_country_selector:1.6.5:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/6c5a4bce-6266-4cfc-bc87-4fc3e36cb479 https://cybersecurityworks.com/zerodays/cve-2022-28290-reflected-cross-site-scripting-in-welaunch.html https://nvd.nist.gov/vuln/detail/CVE-2022-28290 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2