Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload
high
The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in vulnerable configuratio...
- CVSS:
- 7.5
- Affected:
- up to 2.0.9
- Fixed in:
- 2.0.10
- Disclosed:
- Jan 16, 2026
CVE-2025-14478 on NVD →
Demo Importer Plus <= 2.0.8 - Missing Authorization
medium
The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
- CVSS:
- 4.3
- Affected:
- up to 2.0.8
- Fixed in:
- 2.0.9
- Disclosed:
- Jan 5, 2026
CVE-2025-69091 on NVD →
Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation
high
The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber...
- CVSS:
- 8.8
- Affected:
- up to 2.0.8
- Fixed in:
- 2.0.9
- Disclosed:
- Dec 17, 2025
CVE-2025-14364 on NVD →
Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
high
The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. This makes it possible fo...
- CVSS:
- 8.8
- Affected:
- up to 2.0.6
- Fixed in:
- 2.0.7
- Disclosed:
- Dec 4, 2025
CVE-2025-13066 on NVD →
Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
medium
The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrar...
- CVSS:
- 6.4
- Affected:
- up to 2.0.1
- Fixed in:
- 2.0.2
- Disclosed:
- Oct 1, 2024
CVE-2024-9172 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database