WordPress Plugin Vulnerabilities

Import users from CSV with meta <= 1.14.0.2 - XSS and CSRF

Description

The Import and export users and customers WordPress plugin was affected by a XSS and CSRF security vulnerability.

Affects Plugins

Plugin icon
import-users-from-csv-with-meta
Fixed in 1.14.0.3

References

CVE
CVE-2019-15329
CVE
CVE-2019-15328
URL
https://plugins.trac.wordpress.org/changeset?reponame=&new=2050450%40import-users-from-csv-with-meta&old=2050003%40import-users-from-csv-with-meta

Miscellaneous

Original Researcher
ApplicationSecurity
Verified
No
WPVDB ID
4e906600-a9e8-4151-9cb6-fd3bc0841b27

Timeline

Publicly Published
2019-03-14 (about 7 years ago)
Added
2019-06-20 (about 6 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2015-05-02
Title
Ad Inserter 1.5.2 - CSRF & XSS
Published
2014-08-01
Title
Sharebar <= 1.2.1 - SQL Injection & Cross Site Scripting
Published
2016-08-24
Title
CYSTEME Finder <= 1.3 - Unauthenticated LFI and Unauthenticated File Upload
Published
2016-03-07
Title
SP Projects & Document Manager < 2.6.0.0 - Multiple Vulnerabilities
Published
2020-02-24
Title
Ultimate Membership Pro < 8.6.2 - Multiple CSRF Issues via AJAX Calls, Insufficient Filename Entropy