Read the docs

AddonsPress

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

AddonsPress records in CISA KEV

No AddonsPress vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Advanced Import 1 record MEDIUM

Records

3 records

TI-2022-03382 CVE-2022-3677 · GHSA-rm98-3vrx-q6wp

Advanced Import < 1.3.8 - Arbitrary Plugin Installation & Activation via CSRF

Priority MEDIUM 62

The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and a…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00374 Published 2022-12-05 Fixed in 1.3.8
TI-2025-19821 CVE-2025-26950 · GHSA-cc9c-7qxf-mf3r

WordPress Nepali Date Converter plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonsPress Nepali Date Converter nepali-date-converter allows Stored XSS.This issue affects Nepali Date Converter: fr…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00274 Published 2025-04-15 No fix listed CWE-79
TI-2026-03767 CVE-2026-4328 · GHSA-qvcr-v37j-859c

Server-side request forgery in AddonsPress Advanced Import

Priority LOW 28

The Advanced Import plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.6.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00342 Published 2026-06-19 No fix listed CWE-918
Open these records in search →