Advisories · Technology
wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets.
Every CVE that names wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.1 Medium
WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'
- wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
- Code injection
- CVSS 8.8 High
Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic
- wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
- Code injection
- CVSS 7.2 High
Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload
- wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
- Unrestricted file upload
- CVSS 7.2 HighCritical · CVSS 7+ and EPSS
Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
- wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
- Unrestricted file upload