Cross-Site Scripting Vulnerability in WP All Import for WordPress

CVE-2018-16255

Summary

An XSS vulnerability exists in version 3.4.9 of the WP All Import plugin for WordPress, allowing authenticated administrators to exploit the action=evaluate functionality. While this vulnerability is limited to users with administrative privileges, it poses a risk if an admin is compromised, as attackers could execute malicious scripts. It is advisable for administrators to review their user access and implement security best practices to mitigate potential exploitation risks.

References