Vulnerabilidades

Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.

Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.

A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that could expose information about the Application-Server and the used XML-Framework.

The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack.

themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database.

themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook.

Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.

The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.

The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.

The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data.

Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.

Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM.

Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.

The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.

The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.

The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.

The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.

The wp-all-import plugin before 3.4.7 for WordPress has XSS.

The wp-all-import plugin before 3.4.6 for WordPress has XSS.

The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.

The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.

The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.

The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.

The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.