CVE Database /
CVE-2022-27856
CVE · Low
CVE-2022-27856 — Export All URLs [export-all-urls] < 4.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2022-27856
|
Export All URLs [export-all-urls] < 4.2 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Low
3.4
|
< 4.2
|
4.2 |
2023-05-10 |
—
|
CVE-2022-27856
The Export All URLs plugin before version 4.2 fails to properly sanitize and escape the url and title fields during post list exports, enabling editors and administrators to inject malicious scripts that persist in the database. This Stored Cross-Site Scripting vulnerability can be exploited even in restricted environments where unfiltered HTML capability is disabled, such as multisite WordPress installations.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings