CVSS: 9.0EPSS: 5%CPEs: 1EXPL: 0CVE-2023-4142 – WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution
https://notcve.org/view.php?id=CVE-2023-4142
03 Aug 2023 — The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means remote code execution is still possible for si... • https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.9.6/importExtensions/ImportHelpers.php#L205 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3860 – Visual Email Designer for WooCommerce < 1.7.2 - Multiple Author+ SQLi
https://notcve.org/view.php?id=CVE-2022-3860
09 Dec 2022 — The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author. El complemento Visual Email Designer for WooCommerce de WordPress anterior a 1.7.2 no sanitiza ni escapa adecuadamente un parámetro antes de usarlo en una declaración SQL, lo que genera una inyección de SQL explotable por usuarios con un rol tan bajo como el de autor. The Vis... • https://wpscan.com/vulnerability/d99ce21f-fbb6-429c-aa3b-19c4a5eb7557 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3243 – Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi
https://notcve.org/view.php?id=CVE-2022-3243
20 Sep 2022 — The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin El plugin Import all XML, CSV & TXT de WordPress versiones anteriores a 6.5.8, no sanea y escapa apropiadamente de los datos importados antes de usarlos en las sentencias SQL, conllevando a una inyección SQL que puede ser explotada por usuarios con altos privilegios, como el admini... • https://wpscan.com/vulnerability/9f03bc1a-214f-451a-89fd-2cd3517e8f8a • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3244 – Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation
https://notcve.org/view.php?id=CVE-2022-3244
20 Sep 2022 — The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access some of the plugin features if they manage to get the related nonce El plugin Import all XML, CSV & TXT de WordPress versiones anteriores a 6.5.8 no presenta autorización en algunos lugares, lo que podría permitir a cualquier usuario autenticado acceder a algunas de las funciones del plugin si consigue conseguir el nonce relacionado The WP Ultimate C... • https://wpscan.com/vulnerability/de4bc449-3dd4-4776-943f-ac59ae813132 • CWE-862: Missing Authorization •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1977 – WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRF
https://notcve.org/view.php?id=CVE-2022-1977
02 Jun 2022 — The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks El plugin Import Export All WordPress Images, Users & Post Types de WordPress versiones anteriores a 6.5.3, no comprueba completamente el archivo a importar por medio de una URL antes de realizar una petición HTTP al mismo, lo que podría pe... • https://wpscan.com/vulnerability/1b640519-75e1-48cb-944e-b9bff9de6d3d • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0360 – WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-0360
26 Jan 2022 — The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues El plugin Easy Drag And Drop All Import : WP Ultimate CSV Importer de WordPress versiones anteriores a 6.4.3, no sanea y escapa de los comentarios importados, lo que podría permitir a usuarios con altos privilegios importar comenta... • https://plugins.trac.wordpress.org/changeset/2662897 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20967 – Easy Drag And drop All Import : WP Ultimate CSV Importer <= 5.6 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2018-20967
13 Aug 2019 — The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. El plugin wp-ultimate-csv-importer versiones anteriores a 5.6.1 para WordPress, presenta una vulnerabilidad de tipo CSRF. • https://wordpress.org/plugins/wp-ultimate-csv-importer/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20968 – Export WordPress Data with Advanced Filters <= 1.4.1 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2018-20968
19 Dec 2018 — The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF. El plugin wp-ultimate-exporter versiones anteriores a 1.4.2 para WordPress, presenta una vulnerabilidad de tipo CSRF. The Export WordPress Data with Advanced Filters plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.1. This is due to missing or incorrect nonce validation on the export_module() function. This makes it possible for unauthenticated attackers to export module data via a forg... • https://wordpress.org/plugins/wp-ultimate-exporter/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2016-10984 – Echo Sign < 1.2 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10984
21 Apr 2016 — The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. El plugin echosign versiones anteriores a 1.2 para WordPress, presenta una vulnerabilidad de tipo XSS por medio del parámetro page del archivo inc.php. • https://0x62626262.wordpress.com/2016/04/21/echosign-plugin-for-wordpress-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2016-10985 – Echo Sign < 1.2 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10985
21 Apr 2016 — The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. El plugin echosign versiones anteriores a 1.2 para WordPress, presenta una vulnerabilidad de tipo XSS por medio del parámetro id del archivo templates/add_templates.php. • https://0x62626262.wordpress.com/2016/04/21/echosign-plugin-for-wordpress-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •