The Awin Data Feed WordPress plugin through 1.6 does not sanitise and escape a header when processing request to generate analytics data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against a logged in admin viewing the plugin’s settingsRead More
CVE-2022-1938
![](https://api-security.blog/wp-content/uploads/2022/07/cve-min-1-1024x683.png)