Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Soflyy Component: Export Any Wordpress Data To Xml/csv Clear all filters
TI-2023-06478 CVE-2023-7082 · GHSA-p3c5-46w2-82qj

WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE

Priority LOW 34

The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01231 Published 2024-01-22 Fixed in 3.7.3
TI-2023-05417 CVE-2023-5882 · GHSA-7xp2-7hw7-rv8q

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF

Priority HIGH 73

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0055 Published 2023-12-18 Fixed in 1.4.0, 1.8.6 CWE-352
TI-2023-04352 CVE-2023-4724 · GHSA-gj3x-fvqg-gcjm

WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE

Priority HIGH 67

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary co…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01151 Published 2023-12-18 Fixed in 1.4.0, 1.8.6
TI-2023-05420 CVE-2023-5886 · GHSA-qgv4-xfrj-hvp7

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF

Priority LOW 39

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the abili…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0055 Published 2023-12-18 Fixed in 1.4.0, 1.8.6 CWE-352
TI-2022-01666 CVE-2022-1800 · GHSA-g5h6-jgmp-66hj

Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection

Priority LOW 34

The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01301 Published 2022-06-13 Fixed in 1.3.5 CWE-89