plugin

Import Csv Files Vulnerabilities

2 known security issues reported for the Import Csv Files WordPress plugin. Most recent disclosed Jul 17, 2022.

1 medium

Running Import Csv Files on your site? Check whether your installed version is affected.

Scan your site free

Import CSV Files [import-csv-files] <= 1.0 (unfixed + closed)

unknown

[en] The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check when performing such action as well, resulting in a Reflected Cross-Site Scripting

Affected:
up to 1.0
Fix:
No patched version reported
Disclosed:
Jul 17, 2022

CVE-2022-2146 on NVD →

Import CSV Files <= 1.0 - Reflected Cross-Site Scripting

medium

The Import CSV Files plugin for WordPress is vulnerable to Reflected Cross-Site Scripting through imported content in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on the supplied file data. This makes it possible for unauthenticated attackers to inject arbitrary web scri...

CVSS:
6.1
Affected:
up to 1.0
Fix:
No patched version reported
Disclosed:
Jun 21, 2022

CVE-2022-2146 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database