CVE-2022-1937

CVE-2022-1937: Awin Data Feed < 1.8 - Reflected Cross-Site Scripting

Vendor Unknown

Product Awin Data Feed

Weakness CWE-79 · XSS

Published July 11, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting

Key dates

02Disclosure timeline

July 11, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1937 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2026-41241 pretalx: Stored cross-site scripting in organiser search typeahead CVE-2024-27183 Extension - dj-extensions.com - XSS vulnerability in DJ-HelpfulArticles component for Joomla 1.0.0-1.1.0 CVE-2023-0731 Interactive Geo Maps <= 1.5.9 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2026-9357 vBulletin Login cross site scripting CVE-2024-3084 PHPGurukul Emergency Ambulance Hiring Portal Hire an Ambulance Page cross site scripting