Skip to content
Sign in
Not rated

CVE-2022-2071 The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking…

Description

The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them.

Affected products and versions

Product Affected versions Fixed in
Name Directory 1.25 earliest → < 1.25.4 1.25.4

Other CVEs of Name Directory

The 2 CVEs of Name Directory →
CVE-2022-2072 The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back… Not rated
Track this CVE