7.2
High
CVE-2023-7082 The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip…
Description
The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Import any XML or CSV File to WordPress 3.7 | earliest → < 3.7.3 | 3.7.3 |
Other CVEs of Import any XML or CSV File to WordPress
The 5 CVEs of Import any XML or CSV File to WordPress →
CVE-2022-2711
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in…
7.2
High
CVE-2022-3418
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are…
7.2
High
CVE-2022-2268
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip…
Not rated
CVE-2021-24714
The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier…
Not rated