Export Post Info Vulnerabilities

The Export Post Info plugin for WordPress is vulnerable to CSV Injection. This allows authenticated users with author permissions or higher, to inject commands that the plugin will include when generating a CSV file for export. If a victim opens the malicious CSV file on a vulnerable platform these commands could be ex...

CVSS:

5.4

Affected:

up to 1.2.0

Fixed in:

1.2.1

Disclosed:

Sep 22, 2022

CVE-2022-38061 on NVD →

The Export Post Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘epi_random_string_filename’ parameter in versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissio...

CVSS:

5.5

Affected:

up to 1.1.0

Fixed in:

1.2.0

Disclosed:

Sep 7, 2022

CVE-2022-38068 on NVD →