PT-2026-3354 · WordPress · Demo Importer Plus

Lorenzo Franchini · Published 2026-01-17 · Updated 2026-01-22 · CVE-2025-14478

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Demo Importer Plus plugin for WordPress versions up to and including 2.0.9

Description The software is susceptible to XML External Entity Injection (XXE) through the SVG file upload functionality. This allows authenticated attackers with Author-level access or higher to potentially achieve code execution in vulnerable configurations. This issue only impacts sites using PHP versions older than 8.0.

Recommendations Update the Demo Importer Plus plugin to a version newer than 2.0.9. For sites using PHP versions older than 8.0, consider alternative methods for importing demos that do not involve SVG file uploads.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-14478

Affected Products

Demo Importer Plus

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14478 · Security Note
• https://plugins.trac.wordpress.org/changeset/3439643/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php · Note
• https://plugins.trac.wordpress.org/browser/demo-importer-plus/tags/2.0.6/inc/importers/class-demo-importer-plus-sites-helper.php#L88 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b2971aa0-8287-4142-bd04-7aec1ed92e7b?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2012448206446014937 · Twitter Post
• https://plugins.trac.wordpress.org/browser/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php#L88 · Note
• https://twitter.com/CVEnew/status/2012490341685825756 · Twitter Post
• https://twitter.com/cracbot/status/2014291998975619101 · Twitter Post