Advisories · Technology
kraftplugins Demo Importer Plus.
Every CVE that names kraftplugins Demo Importer Plus among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload
- kraftplugins Demo Importer Plus
- XML external entities (XXE)
- CVSS 8.8 High
Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation
- kraftplugins Demo Importer Plus
- Broken access control
- CVSS 8.8 High
Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
- kraftplugins Demo Importer Plus
- Unrestricted file upload
- CVSS 6.4 Medium
Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- kraftplugins Demo Importer Plus
- Cross-site scripting (XSS)