CVE-2022-3558

🗓️ 07 Nov 2022 00:00:00Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 51 Views🌐 WEB

The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. NV

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2022-3558	7 Nov 202212:34	–	circl
CNNVD	WordPress plugin Import and export users and customers 安全漏洞	7 Nov 202200:00	–	cnnvd
Cvelist	CVE-2022-3558 Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection	7 Nov 202200:00	–	cvelist
EUVD	EUVD-2022-42924	3 Oct 202520:07	–	euvd
NVD	CVE-2022-3558	7 Nov 202210:15	–	nvd
OSV	CVE-2022-3558	7 Nov 202210:15	–	osv
Prion	Code injection	7 Nov 202210:15	–	prion
Positive Technologies	PT-2022-22908 · WordPress · Export/Import Users/Customers	7 Nov 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-3558	22 May 202523:14	–	redhatcve
Vulnrichment	CVE-2022-3558 Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection	7 Nov 202200:00	–	vulnrichment

NVD

Vulners

Node

codection import_and_export_users_and_customersRange<1.20.5wordpress

[
  {
    "vendor": "Unknown",
    "product": "Import and export users and customers",
    "versions": [
      {
        "version": "1.20.5",
        "status": "affected",
        "lessThan": "1.20.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/e3d72e04-9cdf-4b7d-953e-876e26abdfc6
plugins	www.plugins.trac.wordpress.org/changeset

Parameter	Position	Path	Description	CWE
nickname	query param	wp-admin/tools.php?page=acui&tab=export	CSV export escaping vulnerability allows injection via nickname value in exported data	CWE-1236

01 May 2025 20:15Current

7.9High risk

Vulners AI Score7.9

CVSS 3.18

EPSS0.00838

SSVC

CWE-1236