CVE-2022-0360 WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting

What is CVE-2022-0360?

CVE-2022-0360 is a medium-severity cross-site scripting vulnerability in Unknown Easy Drag And drop All Import : WP Ultimate CSV Importer, published on 28 Feb 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues

Weakness: CWE-79

Which versions are affected by CVE-2022-0360?

It affects 1 product.

Products include Smackcoders Import All Pages\, Post Types\, Products\, Orders\, and Users as Xml \& Csv.

How do I fix CVE-2022-0360?

No fix has been published for CVE-2022-0360 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-0360 being exploited?

There is no known exploitation of CVE-2022-0360 in the wild and no public exploit code.

Other vulnerabilities in Unknown Easy Drag And drop All Import : WP Ultimate CSV Importer

• CVE-2018-20967 Cross-site request forgery in n/a High 8.8
• CVE-2022-3243 Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi High 7.2
• CVE-2022-1977 WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRF High 7.2
• CVE-2015-9306 Cross-site scripting in n/a Medium 6.1
• CVE-2015-10125 WP Ultimate CSV Importer Plugin cross-site request forgery Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xc3c-6399-cmgj.