CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9624 – WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import
https://notcve.org/view.php?id=CVE-2024-9624
16 Dec 2024 — The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxi_curl_download function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On cloud platforms, it might allow attackers to read the Instance... • https://www.wordfence.com/threat-intel/vulnerabilities/id/eabde2e7-5cd4-4c3e-959a-69e04f6350d3?source=cve • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3418 – WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE
https://notcve.org/view.php?id=CVE-2022-3418
17 Oct 2022 — The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files El complemento Importar cualquier archivo XML o CSV a WordPress anterior a 3.6.9 no filtra correctamente qué extensiones de archivo se pueden importar en el servidor, lo que podría permitir a los administradores de instalaciones de WordPress en varios sitios ca... • https://wpscan.com/vulnerability/ccbb74f5-1b8f-4ea6-96bc-ddf62af7f94d • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2711 – WP All Import < 3.6.9 - Admin+ Directory traversal via file upload
https://notcve.org/view.php?id=CVE-2022-2711
17 Oct 2022 — The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector. El complemento Importar cualquier archivo XML o CSV a WordPress anterior a 3.6.9 no valida las rutas de los archivos contenidos en los archivos zip cargados, lo que permite a usuarios con privilegios elevados, c... • https://wpscan.com/vulnerability/11e73c23-ff5f-42e5-a4b0-0971652dcea1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2268 – WP All Import < 3.6.8 - Admin+ Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2022-2268
01 Jul 2022 — The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE El plugin Import any XML or CSV File to de WordPress versiones anteriores a 3.6.8, acepta todos los archivos zip y extrae automáticamente el archivo zip sin validar el tipo de archivo extraído. Permitiendo a usuarios con altos privilegios, como ... • https://wpscan.com/vulnerability/578093db-a025-4148-8c4b-ec2df31743f7 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36386 – WordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerability
https://notcve.org/view.php?id=CVE-2022-36386
28 Jun 2022 — Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. Una vulnerabilidad de Ejecución de Código Arbitrario Autenticado en el plugin Soflyy Import any XML or CSV File to WordPress versiones anteriores a 3.6.7 incluyéndola, en WordPress The WP All Import plugin for WordPress is vulnerable to arbitrary code execution in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator-level... • https://patchstack.com/database/vulnerability/wp-all-import/wordpress-import-any-xml-or-csv-file-to-wordpress-plugin-3-6-7-authenticated-arbitrary-code-execution-vulnerability • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24714 – WP All Import < 3.6.3 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24714
02 Nov 2021 — The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed. El plugin Import any XML or CSV File to de WordPress versiones anteriores a 3.6.3, no escapa de los campos Title y Unique Identifier de la importación antes de mostrarlos en las páginas de administración, que podría perm... • https://wpscan.com/vulnerability/a8d314b9-26ac-4b56-a85c-a2528e55e73a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9331 – Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks
https://notcve.org/view.php?id=CVE-2015-9331
20 Aug 2019 — The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit. El plugin wp-all-import antes de 3.2.4 para WordPress no tiene prevención de solicitudes no autenticadas a adminInit. • https://wordpress.org/plugins/wp-all-import/#developers • CWE-254: 7PK - Security Features CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16259
https://notcve.org/view.php?id=CVE-2018-16259
12 Apr 2019 — There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator Existe una vulnerabilidad Cross-Site Scripting (XSS) en el plugin WP All Import versión 3.4.9 para WordPress mediante pmxi-admin-settings large_feed_limit.NOTA: El proveedor declara que... • https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16258
https://notcve.org/view.php?id=CVE-2018-16258
12 Apr 2019 — There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator ** EN DISPUTA ** Vulnerabilidad de Cross-Site Scripting (XSS) en el plugin WP All Import versión 3.4.9 para WordPress mediante pmxi-admin-import custom_type.NOTA: El proveedor declara que esto... • https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16257
https://notcve.org/view.php?id=CVE-2018-16257
12 Apr 2019 — There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator Hay múltiples vulnerabilidades de XSS (cross site scripting) en el plugin WP All Import, versión 3.49 para WordPress, vía action=template.NOTA: El proveedor declara que esto no es una vulnerabilida... • https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •