PT-2019-9288 · WordPress · Wp All Import

Mohammed Ansari S · Published 2019-04-12 · Updated 2024-08-05 · CVE-2018-16256

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP All Import plugin version 3.4.9

Description The issue concerns an XSS vulnerability in the WP All Import plugin for WordPress. It can be exploited via the Add Filtering Options (Add Rule) feature. The vendor has stated that this is not considered a vulnerability because the plugin can only be used by a logged-in administrator, and the described action can only be taken advantage of by a logged-in administrator.

Recommendations For WP All Import plugin version 3.4.9, consider restricting access to the Add Filtering Options (Add Rule) feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-16256

Affected Products

Wp All Import

References · 4

• 🔥 https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing · Exploit
• https://osv.dev/vulnerability/CVE-2018-16256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16256 · Security Note
• https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html · Note