¿Es seguro Wp All Export?

Qué hace este plugin

• Slug: wp-all-export
• 100000+ instalaciones activas

exportexport woocommercemigratewordpress csv exportwordpress xml export

Estado de mantenimiento

• Última versión conocida: 1.5.0
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

6 CVEs conocidos registrados para Wp All Export.

CVE-2023-5886

The Export any WordPress data to XML/CSV plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 1.4.1, and in versions up to 1.8.6 in the PRO version. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to perform unauthorized actions and deserialize a PHAR object and potentially achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-4724

Update the WordPress Export any WordPress data to XML/CSV plugin to the latest available version (at least 1.4.0). Francesco Marano (@mrnfrancesco), Donato Di Pasquale (@ddipa) discovered and reported this Remote Code Execution (RCE) vulnerability in WordPress Export any WordPress data to XML/CSV Plugin. This could allow a malicious actor to execute commands on the target website. This can be used to gain backdoor access to then take full control of the website. This vulnerability has been fixed in version 1.4.0.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-5882

Update the WordPress Export any WordPress data to XML/CSV plugin to the latest available version (at least 1.4.1). Francesco Marano (@mrnfrancesco), Donato Di Pasquale (@ddipa) discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Export any WordPress data to XML/CSV Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 1.4.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel [wp-all-export] < 1.3.6

Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress Export any WordPress data to XML/CSV plugin (versions <= 1.3.5). Update the WordPress Export any WordPress data to XML/CSV plugin to the latest available version (at least 1.3.6).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel [wp-all-export] < 1.3.6

The Export any WordPress data to XML/CSV plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 1.3.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-1800

Authenticated SQL Injection (SQLi) vulnerability discovered by Asif Nawaz Minhas in WordPress Export any WordPress data to XML/CSV plugin (versions <= 1.3.4). Update the WordPress Export any WordPress data to XML/CSV plugin to the latest available version (at least 1.3.5).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2021-24708

The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-1582

The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download endpoint. This is due to a PHP type juggling vulnerability in the security token comparison which uses loose comparison (==) instead of strict comparison (===). This makes it possible for unauthenticated attackers to bypass authentication using "magic hash" values when the expected MD5 hash prefix happens to be numeric-looking (matching pattern ^0e\d+$), allowing download of sensitive export files containing PII, business data, or database information.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 1 vulnerabilidad conocida más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel [wp-all-export] < 1.3.6	—	Desconocido	< 1.3.6	1.3.6	—	✓ corregido en la última versión

WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel [wp-all-export] < 1.3.6

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Wp All Export actualizado — 1.5.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Customizer Export/Import — 100000+ instalaciones activas — 96/100 (115) — PHP máx. 8.4
• Advanced Order Export For WooCommerce — 100000+ instalaciones activas — 100/100 (350) — PHP máx. <8.0
• Export All URLs — 50000+ instalaciones activas — 92/100 (94) — PHP máx. 8.4
• Export media with selected content (by DKZR) — 40000+ instalaciones activas — 90/100 (93) — PHP máx. 8.4
• WP Import Export Lite — 40000+ instalaciones activas — 80/100 (113)