CVE-2022-1938

Name of the Vulnerable Software and Affected Versions Awin Data Feed WordPress plugin versions prior to 1.8

Description The issue allows unauthenticated users to perform Stored Cross-Site Scripting attacks against a logged-in admin viewing the plugin's settings. This is due to the plugin not sanitizing and escaping a header when processing requests to generate analytics data.

Recommendations For versions prior to 1.8, update to version 1.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings page to minimize the risk of exploitation.