Medium severity4.8NVD Advisory· Published Dec 6, 2021· Updated Jun 17, 2026

CVE-2021-24714

Description

The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Soflyy/Wp All Import
cpe:2.3:a:soflyy:wp_all_import:*:*:*:*:*:wordpress:*:*
Range: <3.6.3
WordPress/Import Any XML Or CSV File To Wordpressinferred2 versions
<3.6.3+ 1 more
- (no CPE)range: <3.6.3
- (no CPE)range: <3.6.3
Package: https://wordpress.org/plugins/import-any-xml-or-csv-file-to-wordpress

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/a8d314b9-26ac-4b56-a85c-a2528e55e73anvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000