CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1977 – WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRF
https://notcve.org/view.php?id=CVE-2022-1977
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks El plugin Import Export All WordPress Images, Users & Post Types de WordPress versiones anteriores a 6.5.3, no comprueba completamente el archivo a importar por medio de una URL antes de realizar una petición HTTP al mismo, lo que podría permitir a usuarios con altos privilegios, como el administrador, llevar a cabo ataques de tipo SSRF Ciego • https://wpscan.com/vulnerability/1b640519-75e1-48cb-944e-b9bff9de6d3d • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0360 – WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-0360
The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues El plugin Easy Drag And Drop All Import : WP Ultimate CSV Importer de WordPress versiones anteriores a 6.4.3, no sanea y escapa de los comentarios importados, lo que podría permitir a usuarios con altos privilegios importar comentarios maliciosos (intencionadamente o no) y conllevar problemas de tipo Cross-Site Scripting Almacenado. • https://plugins.trac.wordpress.org/changeset/2662897 https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20967 – Easy Drag And drop All Import : WP Ultimate CSV Importer <= 5.6 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2018-20967
The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. El plugin wp-ultimate-csv-importer versiones anteriores a 5.6.1 para WordPress, presenta una vulnerabilidad de tipo CSRF. • https://wordpress.org/plugins/wp-ultimate-csv-importer/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20968 – Export WordPress Data with Advanced Filters <= 1.4.1 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2018-20968
The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF. El plugin wp-ultimate-exporter versiones anteriores a 1.4.2 para WordPress, presenta una vulnerabilidad de tipo CSRF. The Export WordPress Data with Advanced Filters plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.1. This is due to missing or incorrect nonce validation on the export_module() function. This makes it possible for unauthenticated attackers to export module data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wordpress.org/plugins/wp-ultimate-exporter/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2016-10984 – Echo Sign < 1.2 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10984
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. El plugin echosign versiones anteriores a 1.2 para WordPress, presenta una vulnerabilidad de tipo XSS por medio del parámetro page del archivo inc.php. • https://0x62626262.wordpress.com/2016/04/21/echosign-plugin-for-wordpress-xss-vulnerability https://wordpress.org/plugins/echosign/#developers https://wpvulndb.com/vulnerabilities/8465 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •