Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
soflyy vulnerabilities and exploits
(subscribe to this query)
7.2
CVSSv3
CVE-2023-4724
The Export any WordPress data to XML/CSV WordPress plugin prior to 1.4.0, WP All Export Pro WordPress plugin prior to 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an malicious user to run arbitrary command on the remote server
Soflyy Export Any Wordpress Data To Xml\\/csv
Soflyy Wp All Export
8.8
CVSSv3
CVE-2023-5882
The Export any WordPress data to XML/CSV WordPress plugin prior to 1.4.0, WP All Export Pro WordPress plugin prior to 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing malicious users to make logged in users perform unwanted actions leading to remo...
Soflyy Wp All Export
Soflyy Export Any Wordpress Data To Xml\\/csv
8.8
CVSSv3
CVE-2023-5886
The Export any WordPress data to XML/CSV WordPress plugin prior to 1.4.0, WP All Export Pro WordPress plugin prior to 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwan...
Soflyy Wp All Export
Soflyy Export Any Wordpress Data To Xml\\/csv
8.8
CVSSv3
CVE-2022-46841
Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Oxygen Builder plugin <= 4.4 versions.
Soflyy Oxygen
5.4
CVSSv3
CVE-2023-6938
The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
Soflyy Oxygen
7.2
CVSSv3
CVE-2022-2268
The Import any XML or CSV File to WordPress plugin prior to 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
Soflyy Wp All Import
6.1
CVSSv3
CVE-2018-20978
The wp-all-import plugin prior to 3.4.7 for WordPress has XSS.
Soflyy Wp All Import
4.8
CVSSv3
CVE-2021-24714
The Import any XML or CSV File to WordPress plugin prior to 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capabil...
Soflyy Wp All Import
6.1
CVSSv3
CVE-2018-0546
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an malicious user to inject arbitrary web script or HTML via unspecified vectors.
Soflyy Wp All Import
6.1
CVSSv3
CVE-2018-0547
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an malicious user to inject arbitrary web script or HTML via unspecified vectors.
Soflyy Wp All Import
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-32744
privilege escalation
CVE-2024-30253
CVE-2024-3914
cross-site scripting
CVE-2024-31497
CVE-2024-3400
CVE-2024-32341
hardcoded
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
NEXT »