Codection import users from csv with meta vulnerabilities

Latest Codection import users from csv with meta CVEs

Newest publication first

1. CVE-2019-15326 Import and export users and customers <= 1.14.2.1 - Directory Traversal

   Published 2019-08-22

   High·CVSS 7.5 EPSS 2.3%

   The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.

2. CVE-2019-15327 Import and export users and customers <= 1.14.1.2 - Cross-Site Scripting

   Published 2019-08-22

   Medium·CVSS 6.1 EPSS 0.91%

   The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.

3. CVE-2019-15328 Import and export users and customers <= 1.14.0.2 - Cross-Site Scripting

   Published 2019-08-22

   Medium·CVSS 6.1 EPSS 0.93%

   The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.

4. CVE-2019-15329 Import and export users and customers <= 1.14.0.2 - Cross-Site Request Forgery

   Published 2019-08-22

   High·CVSS 8.8 EPSS 0.69%

   The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.

5. CVE-2019-14683 Import and export users and customers <= 1.14.1.3 - Cross-Site Request Forgery leading to attachment deletion & Path Traversal

   Published 2019-08-08

   Medium·CVSS 5.7 EPSS 0.68%

   The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.

6. CVE-2018-20101 Import users from CSV with meta <= 1.12 - Import Cross-Site Scripting

   Published 2018-12-12

   Medium·CVSS 6.1 EPSS 0.78%

   The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.