Read the docs

Soflyy

Records43All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high20CVSS 7.0–8.9

Exploited now

Soflyy records in CISA KEV

No Soflyy vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wp All Import 19 records HIGH Wp All Export 7 records HIGH Export Any Wordpress Data To Xml/csv 5 records HIGH Breakdance 2 records LOW Oxygen 2 records LOW

Records

5 records in Export Any Wordpress Data To Xml/csv · all components

TI-2023-05417 CVE-2023-5882 · GHSA-7xp2-7hw7-rv8q

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF

Priority HIGH 73

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0055 Published 2023-12-18 Fixed in 1.4.0, 1.8.6 CWE-352
TI-2023-04352 CVE-2023-4724 · GHSA-gj3x-fvqg-gcjm

WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE

Priority HIGH 67

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary co…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01151 Published 2023-12-18 Fixed in 1.4.0, 1.8.6
TI-2023-05420 CVE-2023-5886 · GHSA-qgv4-xfrj-hvp7

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF

Priority LOW 39

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the abili…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0055 Published 2023-12-18 Fixed in 1.4.0, 1.8.6 CWE-352
TI-2023-06478 CVE-2023-7082 · GHSA-p3c5-46w2-82qj

WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE

Priority LOW 34

The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01231 Published 2024-01-22 Fixed in 3.7.3
TI-2022-01666 CVE-2022-1800 · GHSA-g5h6-jgmp-66hj

Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection

Priority LOW 34

The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01301 Published 2022-06-13 Fixed in 1.3.5 CWE-89
Open these records in search →