Wp All Import
by WordPress
Source repositories
CVEs (21)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-9330 | Cri | 0.64 | 9.8 | 0.02 | Aug 20, 2019 | The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection. | ||
| CVE-2025-12733 | Hig | 0.57 | 8.8 | 0.01 | Nov 13, 2025 | The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within… | ||
| CVE-2015-9331 | Hig | 0.49 | 7.5 | 0.01 | Aug 20, 2019 | The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit. | ||
| CVE-2022-1565 | Hig | 0.44 | 7.2 | 0.15 | Jul 18, 2022 | The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above,… | ||
| CVE-2025-10001 | Hig | 0.40 | 7.2 | 0.01 | Sep 10, 2025 | The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with… | ||
| CVE-2018-20978 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The wp-all-import plugin before 3.4.7 for WordPress has XSS. | ||
| CVE-2017-18567 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The wp-all-import plugin before 3.4.6 for WordPress has XSS. | ||
| CVE-2015-9329 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS. | ||
| CVE-2018-16259 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be… | ||
| CVE-2018-16258 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken… | ||
| CVE-2018-16257 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken… | ||
| CVE-2018-16256 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken… | ||
| CVE-2018-16255 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by… | ||
| CVE-2018-16254 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by… | ||
| CVE-2024-8722 | Med | 0.36 | 5.5 | 0.00 | Jan 19, 2025 | The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated… | ||
| CVE-2026-2830 | Med | 0.33 | 6.1 | 0.00 | Mar 6, 2026 | The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filepath’ parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output… | ||
| CVE-2018-0547 | Med | 0.33 | 6.1 | 0.01 | Mar 9, 2018 | Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-0546 | Med | 0.33 | 6.1 | 0.01 | Mar 9, 2018 | Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2024-9661 | Med | 0.28 | 4.3 | 0.00 | Feb 7, 2025 | The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported… | ||
| CVE-2024-31939 | Med | 0.28 | 4.3 | 0.00 | Apr 10, 2024 | Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Import any XML or CSV File to WordPress.This issue affects Import any XML or CSV File to WordPress: from n/a through 3.7.3. |
- risk 0.64cvss 9.8epss 0.02
The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
- risk 0.57cvss 8.8epss 0.01
The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within…
- risk 0.49cvss 7.5epss 0.01
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
- risk 0.44cvss 7.2epss 0.15
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above,…
- risk 0.40cvss 7.2epss 0.01
The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with…
- risk 0.40cvss 6.1epss 0.01
The wp-all-import plugin before 3.4.7 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-all-import plugin before 3.4.6 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be…
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken…
- risk 0.40cvss 6.1epss 0.01
There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken…
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken…
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by…
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by…
- risk 0.36cvss 5.5epss 0.00
The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
- risk 0.33cvss 6.1epss 0.00
The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filepath’ parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output…
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.28cvss 4.3epss 0.00
The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported…
- risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Import any XML or CSV File to WordPress.This issue affects Import any XML or CSV File to WordPress: from n/a through 3.7.3.
Page 1 of 2