CVE-2022-0149: 
WordPress vulnerability analysis and mitigation

The WooCommerce Store Exporter WordPress plugin versions before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page. The vulnerability was discovered and publicly disclosed on January 10, 2022 (WPScan).

The vulnerability is classified as a Reflected Cross-Site Scripting (XSS) issue with a CVSS score of 4.8 (medium severity) and is tracked as CWE-79. The vulnerability exists in the woo_ce admin page where user input was not properly sanitized. A proof of concept demonstrates that the vulnerability can be exploited via the URL parameter 'message' in the admin interface (WPScan).

Successful exploitation of this vulnerability could allow attackers to inject malicious scripts that would execute in the context of other users' browsers when they visit the affected admin page. This could potentially lead to theft of sensitive information or unauthorized actions performed on behalf of the administrator (WPScan).

The vulnerability has been fixed in version 2.7.1 of the WooCommerce Store Exporter plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).