4.4
Moyenne
CVE-2024-4734 The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin…
Description
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Import and export users and customers 1.26 | premières → 1.26.6.1 | Pas de correctif indiqué |
| import_and_export_users_and_customers 1.26 | premières → 1.26.6.1 | Pas de correctif indiqué |
Autres CVE de Import and export users and customers
Les 11 CVE de Import and export users and customers →
CVE-2026-120554
Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
8.8
Élevée
CVE-2026-17001
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom…
6.4
Moyenne
CVE-2026-86583
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions…
8.8
Élevée
CVE-2026-15026
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all…
4.3
Moyenne