Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: AddonsPress Clear all filters
TI-2026-03767 CVE-2026-4328 · GHSA-qvcr-v37j-859c

Server-side request forgery in AddonsPress Advanced Import

Priority LOW 28

The Advanced Import plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.6.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00342 Published 2026-06-19 No fix listed CWE-918
TI-2025-19821 CVE-2025-26950 · GHSA-cc9c-7qxf-mf3r

WordPress Nepali Date Converter plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonsPress Nepali Date Converter nepali-date-converter allows Stored XSS.This issue affects Nepali Date Converter: fr…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00274 Published 2025-04-15 No fix listed CWE-79
TI-2022-03382 CVE-2022-3677 · GHSA-rm98-3vrx-q6wp

Advanced Import < 1.3.8 - Arbitrary Plugin Installation & Activation via CSRF

Priority MEDIUM 62

The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and a…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00374 Published 2022-12-05 Fixed in 1.3.8