Now officially on WordPress.org

CVE Database / CVE-2018-20978

CVE · Medium

CVE-2018-20978 — WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets [wp-all-import] < 3.4.7

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2018-0547, CVE-2018-20978 WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets [wp-all-import] < 3.4.7 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.1 < 3.4.7 3.4.7 2018-03-08 —

CVE-2018-0547, CVE-2018-20978

WP All Import versions before 3.4.7 contain a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through the application. The flaw stems from improper input handling in the plugin, enabling attackers to execute arbitrary code in users' browsers when they click on crafted links. This vulnerability was discovered by Yuji Tounai of NTT Communications Corporation and coordinated through JPCERT/CC with the developer.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings