CVE-2022-1255: Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site Scripting

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-02 · updated 2026-06-17
Weakness: CWE-79

Description

The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues

Affected products

carazo Import and export users and customers: before 1.19.2.1 — fixed in 1.19.2.1

How to fix

Upgrade to a fixed version: carazo Import and export users and customers 1.19.2.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/22fe68c4-8f47-491e-be87-5e8e40535a82
https://wpscan.com/vulnerability/22fe68c4-8f47-491e-be87-5e8e40535a82

Get alerted when CVE-2022-1255 or the next vulnerability affects your stack