CVE-2022-4663

2023-01-0314:15:10

CWE-79

[email protected]

web.nvd.nist.gov

wordpress

members import

cve-2022-4663

self xss

input sanitization

output escaping

security vulnerability

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

29.1%

JSON

The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site’s administrator into uploading a CSV file with the malicious payload.

Affected configurations

Vulners

NVD

Node

manishkragmembers_importRange≤1.4.2

CPENameOperatorVersion
youngtechleads:members_importyoungtechleads members importle1.4.2

CPE	Name	Operator	Version
youngtechleads:members_import	youngtechleads members import	le	1.4.2

CNA Affected

[
  {
    "vendor": "manishkrag",
    "product": "Members Import",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.4.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]