CVE Database /
CVE-2024-4734
CVE · Medium
CVE-2024-4734 — Import and export users and customers [import-users-from-csv-with-meta] < 1.26.7
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-4734
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.26.7 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
4.4
|
< 1.26.7
|
1.26.7 |
2024-05-14 |
—
|
CVE-2024-4734
The Import and export users and customers plugin contains a stored cross-site scripting vulnerability in its admin settings affecting versions up to 1.26.6.1, resulting from inadequate input sanitization and output escaping. Attackers with administrator access or higher can inject malicious scripts that execute when users visit affected pages, though the vulnerability only manifests in multi-site WordPress installations or those where the unfiltered_html capability has been restricted. The vulnerability was patched in version 1.26.7.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings