PT-2019-9288 · WordPress · Wp All Import

Mohammed Ansari S · Publicado 2019-04-12 · Atualizado 2024-08-05 · CVE-2018-16256

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP All Import plugin version 3.4.9

Description The issue concerns an XSS vulnerability in the WP All Import plugin for WordPress. It can be exploited via the Add Filtering Options (Add Rule) feature. The vendor has stated that this is not considered a vulnerability because the plugin can only be used by a logged-in administrator, and the described action can only be taken advantage of by a logged-in administrator.

Recommendations For WP All Import plugin version 3.4.9, consider restricting access to the Add Filtering Options (Add Rule) feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-16256

Produtos afetados

Wp All Import

Referências · 4

• 🔥 https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing · Exploit
• https://osv.dev/vulnerability/CVE-2018-16256 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16256 · Nota de Segurança
• https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html · Nota