Gwyn's Imagemap Selector - XSS (CVE-2022-1221)
Description
The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting.
psychologyCrowdSec Analysis
CVE-2022-1221 is a vulnerability in Gwyn's Imagemap Selector WordPress plugin that can lead to reflected cross-site scripting (XSS) due to improper sanitization of input parameters.
CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2022-1221 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec data also reveals a clear uptick in attacks involving CVE-2022-1221 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Attempts to exploit this vulnerability frequently target URLs containing /wp-content/plugins/gwyns-imagemap-selector/popup.php.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2022-05-23 |
| Rule Released | 2025-04-07 |
| CrowdSec First Seen | 2025-04-07 |