JVN#60032768: WordPress plugin "WP All Import" vulnerable to cross-site scripting

The WordPress plugin “WP All Import” provided by Soflyy contains a reflected cross-site scripting vulnerability (CWE-79).

Impact

An arbitrary script may be executed on a logged in user’s web browser.

Solution

Update the plugin
Update the plugin according to the information provided by the developer.

Products Affected

• WP All Import prior to version 3.4.7