amr users <= 4.59.4 - Authenticated (Subscriber+) CSV Injection
medium
The amr users plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 4.59.4. This allows authenticated attackers with subscriber-level permissions or above to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a...
- CVSS:
- 5.5
- Affected:
- up to 4.59.4
- Fix:
- No patched version reported
- Disclosed:
- Mar 22, 2023
CVE-2022-45348 on NVD →
amr users <= 4.59.3 - Admin+ Stored Cross-Site Scripting
medium
The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- CVSS:
- 5.5
- Affected:
- up to 4.59.4
- Fixed in:
- 4.59.4
- Disclosed:
- Apr 4, 2022
CVE-2022-1094 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database