Filtered by vendor Wpallimport Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-10001 2 Wordpress, Wpallimport 2 Wordpress, Import Plugin 2025-09-12 7.2 High
The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload unsafe files like .phar files on the affected site's server which may make remote code execution possible.
CVE-2024-32431 1 Wpallimport 1 Wp All Import 2025-04-02 4.4 Medium
Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2.
CVE-2022-1565 1 Wpallimport 1 Wp All Import 2025-01-31 7.2 High
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.