Cross-Site Scripting Risk in Import Users from CSV with Meta Plugin for WordPress
CVE-2018-20101

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Import Users From Csv With Meta
Vendor
CVE Published:
12 December 2018

What is CVE-2018-20101?

The Import Users from CSV with Meta plugin for WordPress is vulnerable to Cross-Site Scripting (XSS) attacks when processing the value of a cell in imported CSV files. This vulnerability allows an attacker to inject malicious scripts, which can be executed in the context of the user’s browser, potentially leading to unauthorized actions or the exposure of sensitive information. Users should ensure they update to version 1.12.1 or later to mitigate this risk.

References

https://wordpress.org/plugins/import-users-from-csv-with-...
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9176
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.