CVE-2022-1938

MEDIUM 5.4CVE-2022-1938 · Published 11/07/2022 · updated 17/06/2026

In short

CVE-2022-1938 is a MEDIUM (CVSS 5.4) vulnerability affecting awin data feed (awin).
Chance of exploitation in the next 30 days (EPSS): 0.73%, higher than 54.4% of all vulnerabilities.
Fix: update to 1.8 or later.

Package	Affected versions	Patched versions
awin data feed awin	`< 1.8`	`1.8`

Description

The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate analytics data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against a logged in admin viewing the plugin's settings

References

wpscan.com/vulnerability/70aed824-c53e-4672-84c9-039dc34ed5fa · Exploit

More vulnerabilities in awin data feed

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free