What’s Vulnerable › Vulnerabilities

CVE-2018-16257

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-04-12 · updated 2026-06-17
• Weakness: CWE-79

Description

There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator

Affected products

• Import any XML or CSV File to WordPress: 3.4.9

References

• https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html
• https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing
• https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html
• https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing

Get alerted when CVE-2018-16257 or the next vulnerability affects your stack