CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9624 – WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import
https://notcve.org/view.php?id=CVE-2024-9624
16 Dec 2024 — The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxi_curl_download function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On cloud platforms, it might allow attackers to read the Instance... • https://www.wordfence.com/threat-intel/vulnerabilities/id/eabde2e7-5cd4-4c3e-959a-69e04f6350d3?source=cve • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31380 – WordPress Oxygen plugin <= 4.9 - Authenticated Remote Code Execution (RCE) vulnerability
https://notcve.org/view.php?id=CVE-2024-31380
03 Apr 2024 — Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection.This issue affects Oxygen Builder: from n/a through 4.8.3. La vulnerabilidad de control inadecuado de la generación de código ("inyección de código") en Soflyy Oxygen Builder permite la inyección de código. Este problema afecta a Oxygen Builder: desde n/a hasta 4.8.2. Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection. Vend... • https://patchstack.com/database/vulnerability/oxygen/wordpress-oxygen-plugin-4-8-1-auth-remote-code-execution-rce-vulnerability?_s_id=cve • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6938 – Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
https://notcve.org/view.php?id=CVE-2023-6938
05 Jan 2024 — The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Version 4.8.1 of the Oxygen Builder plugin for WordPress addresses this vulnerability by implementing an ... • https://oxygenbuilder.com/oxygen-4-8-1-now-available • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-7082 – WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE
https://notcve.org/view.php?id=CVE-2023-7082
29 Dec 2023 — The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution. El complemento Import any XML or CSV File to WordPress anterior a 3.7.3 acepta todos los archivos zip y extrae automáticamente el archivo zip en un directorio de acc... • https://wpscan.com/vulnerability/7f947305-7a72-4c59-9ae8-193f437fd04e • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 1CVE-2023-4724 – WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE
https://notcve.org/view.php?id=CVE-2023-4724
24 Nov 2023 — The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server Los complementos Export any WordPress data to XML/CSV de WordPress anterior a 1.4.0 y el complemento WP All Export Pro de WordPress anterior a 1.8.6 no validan ni sanitizan el parámetro `wp_query` que permite a un atacante ejecutar comandos arbitrarios en el servid... • https://wpscan.com/vulnerability/48820f1d-45cb-4f1f-990d-d132bfc5536f • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2023-5882 – WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF
https://notcve.org/view.php?id=CVE-2023-5882
24 Nov 2023 — The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution. El complemento Export any WordPress data to XML/CSV de WordPress anterior a 1.4.0, el complemento WP All Export Pro de WordPress anterior a 1.8.6 no verifica los tokens nonce lo suficientemente temprano en el ciclo de vida ... • https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2023-5886 – WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF
https://notcve.org/view.php?id=CVE-2023-5886
24 Nov 2023 — The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution. El complemento Export any WordPress data to XML/CSV de WordPress anterior a 1.4.0, el complemento WP All Export Pro de WordPress anterior a 1.8.6 no v... • https://wpscan.com/vulnerability/0a08e49d-d34e-4140-a15d-ad64444665a3 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46841 – WordPress Oxygen Builder Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2022-46841
20 Jul 2023 — Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Oxygen Builder plugin <= 4.4 versions. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento Soflyy Oxygen Builder en versiones <= 4.4. The Oxygen plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 4.4. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site admin... • https://patchstack.com/database/vulnerability/oxygen/wordpress-oxygen-builder-plugin-4-6-2-cross-site-request-forgery-csrf?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3418 – WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE
https://notcve.org/view.php?id=CVE-2022-3418
17 Oct 2022 — The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files El complemento Importar cualquier archivo XML o CSV a WordPress anterior a 3.6.9 no filtra correctamente qué extensiones de archivo se pueden importar en el servidor, lo que podría permitir a los administradores de instalaciones de WordPress en varios sitios ca... • https://wpscan.com/vulnerability/ccbb74f5-1b8f-4ea6-96bc-ddf62af7f94d • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2711 – WP All Import < 3.6.9 - Admin+ Directory traversal via file upload
https://notcve.org/view.php?id=CVE-2022-2711
17 Oct 2022 — The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector. El complemento Importar cualquier archivo XML o CSV a WordPress anterior a 3.6.9 no valida las rutas de los archivos contenidos en los archivos zip cargados, lo que permite a usuarios con privilegios elevados, c... • https://wpscan.com/vulnerability/11e73c23-ff5f-42e5-a4b0-0971652dcea1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •