Now officially on WordPress.org

CVE Database / CVE-2018-16258

CVE · Medium

CVE-2018-16258 — WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets [wp-all-import] <= 3.4.9

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2018-16258 WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets [wp-all-import] <= 3.4.9 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.1 < 3.4.9 3.4.9 2019-04-12 —

CVE-2018-16258

An XSS vulnerability exists in WP All Import version 3.4.9 and earlier through the pmxi-admin-import custom_type parameter. The vendor disputed this finding, noting that the plugin restricts access to authenticated administrators only, and the vulnerability requires administrator-level privileges to exploit. Despite this classification, the XSS flaw remains present in affected versions up to 3.4.9.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings