CVE-2022-1937 Information

Description

The Awin Data Feed WordPress plugin through 1.6 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users) leading to a Reflected Cross-Site Scripting

Reference

https://wpscan.com/vulnerability/eb40ea5d-a463-4947-9a40-d55911ff50e9