PT-2025-23558 · WordPress · Wordpress Comments Import & Export

Jörg Steinsträter · Published 2025-06-02 · Updated 2025-06-03 · CVE-2025-3919

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Comments Import & Export plugin versions up to 2.4.3

Description The issue arises from a missing capability check on the save settings function and the failure to properly sanitize and escape FTP settings parameters. This allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts on the plugin settings page, which will execute when an administrative user accesses the injected page.

Recommendations For versions up to 2.4.3, update to version 2.4.4 to fully resolve the issue. As a temporary workaround for versions up to 2.4.3, consider restricting access to the plugin settings page to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-3919

Affected Products

Wordpress Comments Import & Export

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3919 · Security Note
• https://plugins.trac.wordpress.org/changeset/3301183 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f8bc8863-04a9-4631-9510-624f98ea1e75?source=cve · Note
• https://t.me/cvetracker/25220 · Telegram Post
• https://plugins.trac.wordpress.org/browser/comments-import-export-woocommerce/trunk/includes/settings/class-hf_cmt_impexpcsv-settings.php?rev=3278076 · Note
• https://t.me/cvenotify/124405 · Telegram Post
• https://twitter.com/CVEnew/status/1929672935511675001 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3288894 · Note