VULNERABILITY INTELLIGENCE

CVE-2022-2071

CVSS score6.1 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2022-07-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them.

Weakness classification

  • CWE-352: Cross-Site Request Forgery (CSRF)

Primary references