Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Import any XML or CSV File to WordPress 3.6.9 Clear all filters
TI-2022-03156 CVE-2022-3418 · GHSA-qff8-jrqx-8xjm

WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE

Priority HIGH 67

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installat…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01455 Published 2022-11-07 Fixed in 3.6.9 CWE-94
TI-2022-02509 CVE-2022-2711 · GHSA-fwj8-64xx-fwh9

WP All Import < 3.6.9 - Admin+ Directory traversal via file upload

Priority HIGH 65

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any p…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.04265 Published 2022-11-07 Fixed in 3.6.9 CWE-22