CVE-2022-1255— Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site Scripting
Quick assessment
Affected
Unknown Import and export users and customers
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Import and export users and customers存在跨站脚本漏洞，该漏洞源于件不会清理和转义导入的 CSV 数据。高权限用户利用该漏洞可以导入恶意 javascript 代码。
Possible ATT&CK Techniques 3 AI
T1059.007 · JavaScript T1189 · Drive-by Compromise T1048 · Exfiltration Over Alternative Protocol
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-1255
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site Scripting
Source: CVE Program / CVE List V5
Vulnerability Description
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Import and export users and customers 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Import and export users and customers存在跨站脚本漏洞，该漏洞源于件不会清理和转义导入的 CSV 数据。高权限用户利用该漏洞可以导入恶意 javascript 代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Import and export users and customers | 1.19.2.1 ~ 1.19.2.1 | - |
|
II. Public POCs for CVE-2022-1255
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-1255
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-1255 (1)
Same Patch Batch · Unknown · 2022-05-02 · 20 CVEs total
| CVE-2022-0773 | Documentor <= 1.5.3 - Unauthenticated SQLi | |
| CVE-2022-1282 | Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting | |
| CVE-2022-1281 | Photo Gallery < 1.6.3 - Unauthenticated SQL Injection | |
| CVE-2022-1273 | Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE | |
| CVE-2022-1269 | Fast Flow < 1.2.12 - Reflected Cross-Site Scripting | |
| CVE-2022-1250 | LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scripting | |
| CVE-2022-1239 | HubSpot < 8.8.15 - Contributor+ Blind SSRF | |
| CVE-2022-1046 | Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-0952 | Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update | |
| CVE-2022-0783 | Multiple Shipping Address Woocommerce < 2.0 - Unauthenticated SQLi | |
| CVE-2021-25002 | Tipsacarrier < 1.5.0.5 - Unauthenticated Orders Disclosure | |
| CVE-2022-0771 | SiteSuperCharger < 5.2.0 - Unauthenticated SQLi | |
| CVE-2022-0662 | Adrotate < 5.8.23 - Admin+ XSS via Advert Name | |
| CVE-2022-0649 | Adrotate < 5.8.23 - Admin+ XSS via Group Name | |
| CVE-2022-0428 | Content Egg < 5.3.0 - Reflected Cross-Site Scripting | |
| CVE-2022-0418 | Event List < 0.8.8 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-0191 | Ad Invalid Click Protector (AICP) < 1.2.7 - Arbitrary Ban Deletion via CSRF | |
| CVE-2021-25102 | All In One WP Security < 4.4.11 - Authenticated Reflected Cross-Site Scripting | |
| CVE-2021-25086 | Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting |
IV. Related Vulnerabilities
Same product: Import and export users and customers
-
CVE-2026-94178
WordPress Import and export users and customers plugin <= 2. -
CVE-2026-86583
Import and export users and customers <= 2.4.17 - Authentica -
CVE-2026-92541
Import and export users and customers < 2.5.2 - Custom Role -
CVE-2026-92540
Import and export users and customers < 2.5.2 - Custom Role -
CVE-2026-16542
Import and export users and customers < 2.4.5 - Admin+ SSRF
Same vendor: Unknown
-
CVE-2026-94238
Loco Translate < 2.8.9 - Translator+ Limited File Read via ' -
CVE-2026-94239
Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle C -
CVE-2026-92923
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscrib -
CVE-2026-96962
Pie Register < 3.8.4.14 - Unauthenticated User Email Disclos -
CVE-2026-89236
SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sor
Same weakness: CWE-79
-
CVE-2026-104313
WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Refle -
CVE-2026-93889
Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site S -
CVE-2026-93896
WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scr -
CVE-2026-92974
Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scri -
CVE-2026-103421
WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Sc
V. Comments for CVE-2022-1255
No comments yet