XSS Vulnerability in WP All Import Plugin for WordPress

CVE-2018-16254

Summary

An XSS vulnerability exists in the WP All Import plugin version 3.4.9 for WordPress, which can be exploited by a logged-in administrator via the action=options parameter. Although the vendor asserts that the risk is mitigated by requiring administrator access for exploitation, this vulnerability could lead to potential security threats if an attacker gains administrative privileges.

References