CVE-2022-1937

The Awin Data Feed WordPress plugin through 1.6 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting

Date published : 2022-07-11

https://wpscan.com/vulnerability/eb40ea5d-a463-4947-9a40-d55911ff50e9