CVE-2022-4663 - Members Import <= 1.4.2 - Self Cross-Site Scripting

Back Back to CVE browser

MEDIUM

Members Import <= 1.4.2 - Self Cross-Site Scripting

Published Jan 3, 2023

6.1

MEDIUM

CVSS 3.1

EPSS 0.65%

Description

The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site's administrator into uploading a CSV file with the malicious payload.

Affected products

Vendor Manishkrag Product Members Import Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.4.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Manishkrag

Members Import

unaffected

Version	Status	Constraints
0	affected	<=1.4.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51987
Advisory
https://plugins.trac.wordpress.org/browser/members-import/trunk/members-import.php#L113
ExploitThird Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/3abbc407-f660-4b1f-9d48-436320e5fdd7
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/3abbc407-f660-4b1f-9d48-436320e5fdd7?source=cve

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51987		Advisory
https://plugins.trac.wordpress.org/browser/members-import/trunk/members-import.php#L113		ExploitThird Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/3abbc407-f660-4b1f-9d48-436320e5fdd7		Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/3abbc407-f660-4b1f-9d48-436320e5fdd7?source=cve