Now officially on WordPress.org

CVE Database / CVE-2018-16257

CVE · Medium

CVE-2018-16257 — WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets [wp-all-import] <= 3.4.9

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2018-16257 WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets [wp-all-import] <= 3.4.9 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.1 < 3.4.9 3.4.9 2019-04-12 —

CVE-2018-16257

The WP All Import plugin version 3.4.9 and earlier contains multiple cross-site scripting flaws through the template action parameter. An authenticated administrator account is required to exploit these vulnerabilities. The vendor disputes the severity classification, arguing that administrative access is necessary to trigger the flaw and that the plugin restricts usage to logged-in administrators.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings