There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
References
| Link | Resource |
|---|---|
| https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html | Third Party Advisory |
| https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing | Permissions Required Third Party Advisory |
| https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html | Third Party Advisory |
| https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing | Permissions Required Third Party Advisory |
Configurations
History
21 Nov 2024, 03:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html - Third Party Advisory | |
| References | () https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - Permissions Required, Third Party Advisory |
07 Nov 2023, 02:53
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator |
Information
Published : 2019-04-12 18:29
Updated : 2024-11-21 03:52
NVD link : CVE-2018-16254
Mitre link : CVE-2018-16254
CVE.ORG link : CVE-2018-16254
JSON object : View
Products Affected
soflyy
- wp_all_import
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')