PT-2019-9286 · WordPress · Wp All Import

Mohammed Ansari S · Published 2019-04-12 · Updated 2024-08-05 · CVE-2018-16254

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP All Import plugin version 3.4.9

Description The issue concerns an XSS vulnerability in the WP All Import plugin for WordPress, specifically via the action=options. It's noted that the vendor does not consider this a vulnerability, as the plugin can only be used by a logged-in administrator, and the described action can only be exploited by a logged-in administrator.

Recommendations For WP All Import plugin version 3.4.9, consider restricting access to the action=options to minimize the risk of exploitation, as the vendor states that only a logged-in administrator can take advantage of this action. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-16254

Affected Products

Wp All Import

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-16254 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16254 · Vendor Advisory
• https://t.me/cvenotify/86677 · Telegram Post
• https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing · Note
• https://t.me/cvenotify/89191 · Telegram Post
• https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html · Note