Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: Soflyy Component: Wp All Export Clear all filters
TI-2024-06881 CVE-2024-7425 · GHSA-xq2h-7fp3-456v

WP All Export Pro <= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update

Priority LOW 34

The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input validation and sanitization in all versions up to, and includ…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00407 Published 2025-02-07 No fix listed CWE-94
TI-2023-05417 CVE-2023-5882 · GHSA-7xp2-7hw7-rv8q

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF

Priority HIGH 73

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0055 Published 2023-12-18 Fixed in 1.4.0, 1.8.6 CWE-352
TI-2023-04352 CVE-2023-4724 · GHSA-gj3x-fvqg-gcjm

WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE

Priority HIGH 67

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary co…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01151 Published 2023-12-18 Fixed in 1.4.0, 1.8.6
TI-2023-05420 CVE-2023-5886 · GHSA-qgv4-xfrj-hvp7

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF

Priority LOW 39

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the abili…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0055 Published 2023-12-18 Fixed in 1.4.0, 1.8.6 CWE-352
TI-2022-03138 CVE-2022-3395 · GHSA-m95q-f33m-cqcq

WP All Export Pro < 1.7.9 - Authenticated SQLi

Priority HIGH 73

The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing users which has been given permission to run exports to execute arbitrary SQL stat…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01246 Published 2022-10-25 Fixed in 1.7.9 CWE-89
TI-2022-03137 CVE-2022-3394 · GHSA-vh4p-xvjw-q6rc

WP All Export Pro < 1.7.9 - Authenticated Code Injection

Priority HIGH 67

The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform expor…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02021 Published 2022-10-25 Fixed in 1.7.9 CWE-94