CVE-2022-28290
Published: May 17, 2026
Official Description
Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the HTTP request
Risk Analysis
This reflective Cross-Site Scripting (XSS) vulnerability in the WordPress Country Selector Plugin allows an attacker to execute malicious scripts in a user's browser. Its inclusion in CISA's KEV catalog confirms active exploitation, making it an urgent concern despite the lack of a CVSS score.
This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog. The attack requires a user to access a crafted URL.
Update the WordPress Country Selector Plugin to a patched version beyond 1.6.5. Implement strong content security policies (CSP) to mitigate the impact of XSS vulnerabilities.
Technical Analysis
CVE-2022-28290 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2022-28290 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2022-28290 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1