CVE-2022-4266

The CVE-2022-4266 entry concerns the WordPress plugin Bulk Delete Users by Email (versions ≤ 1.2). The root cause is a missing CSRF check when deleting users, enabling a CSRF attack to force a logged-in admin to delete non-admin users by knowing their email. Documented impact is unilateral user d...

CVE-2022-4267

CVE-2022-4267 concerns the WordPress plugin Bulk Delete Users by Email (versions up to 1.2 as stated in the primary description). The vulnerability is a reflected cross-site scripting (XSS) caused by lack of proper sanitisation/escaping of a parameter that is output back into the page. Several co...