11 matches found
CVE-2022-3418
CVE-2022-3418 affects the WordPress plugin WP All Import, pre-3.6.9, where improper filtering of allowed import file extensions enables administrators in multisite WordPress installations to upload arbitrary files, potentially leading to remote code execution (RCE). Some sources explicitly descri...
CVE-2022-2711
CVE-2022-2711 affects the WordPress plugin WP All Import (Import any XML or CSV File to WordPress) prior to version 3.6.9. The issue is improper validation of file paths for files inside uploaded zip archives, enabling highly privileged users (admins) to perform path traversal and write arbitrary...
CVE-2015-9331
The CVE-2015-9331 flaw affects the WordPress plugin WP All Import, specifically versions up to 3.2.3 (CVE references also note
CVE-2022-2268
CVE-2022-2268 concerns the WordPress plugin “Import any XML or CSV File to WordPress” (versions before 3.6.8). The vulnerability arises because the plugin accepts all ZIP files and automatically extracts them without validating the extracted file type, enabling high-privilege users (e.g., admins)...
CVE-2024-9664
CVE-2024-9664 affects WP All Import Pro (WordPress) up to version 4.9.7. It enables authenticated administrators (and higher) to trigger a PHP Object Injection via deserialization of untrusted input from an import file. The documented impact includes potential deletion of arbitrary files, data ex...
CVE-2015-9330
The CVE-2015-9330 entry concerns the WordPress plugin wp-all-import, with a blind SQL injection vulnerability reported in versions before 3.2.5. Public sources (NVD, Red Hat, CNVD, CVE lists) consistently describe a SQL injection flaw in this plugin, aligned with a high/critical risk profile (CVS...
CVE-2017-18567
CVE-2017-18567 affects the WordPress wp-all-import plugin prior to 3.4.6, where an XSS vulnerability exists in input handling due to lack of proper validation of client-side data. This could allow attacker-controlled script execution when processing imported XML/CSV data. A fix is available in ve...
CVE-2018-20978
CVE-2018-20978 affects the WordPress wp-all-import plugin for versions prior to 3.4.7. The vulnerability is a cross-site scripting (XSS) flaw caused by insufficient validation of client-supplied data in the plugin, enabling an attacker to run malicious script in a victim’s browser. Public records...
CVE-2018-0546
CVE-2018-0546 corresponds to a cross-site scripting vulnerability in the WordPress plugin WP All Import, affecting versions prior to 3.4.6. The flaw is in the file upload function and allows an attacker to inject arbitrary script or HTML via unspecified vectors. Public references consistently sta...
CVE-2015-9329
The CVE-2015-9329 entry concerns the WordPress plugin wp-all-import . It states that versions before 3.2.5 are vulnerable to reflected XSS . Product: WordPress plugin wp-all-import; Impact: user input reflected in responses leading to XSS; Root cause: improper sanitization/escaping in the affecte...