PT-2019-9286 · WordPress · Wp All Import

Mohammed Ansari S · Publicado 2019-04-12 · Atualizado 2024-08-05 · CVE-2018-16254

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP All Import plugin version 3.4.9

Description The issue concerns an XSS vulnerability in the WP All Import plugin for WordPress, specifically via the action=options. It's noted that the vendor does not consider this a vulnerability, as the plugin can only be used by a logged-in administrator, and the described action can only be exploited by a logged-in administrator.

Recommendations For WP All Import plugin version 3.4.9, consider restricting access to the action=options to minimize the risk of exploitation, as the vendor states that only a logged-in administrator can take advantage of this action. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-16254

Produtos afetados

Wp All Import

Referências · 6

• https://t.me/cvenotify/86677 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-16254 · Nota de Segurança
• https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing · Nota
• https://t.me/cvenotify/89191 · Publicação no Telegram
• https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html · Nota
• https://osv.dev/vulnerability/CVE-2018-16254 · Aviso do Fabricante