CVE-2021-24714

4.8 mediumEPSS 0.6%

Medium (4.8) in soflyy wp all import. EPSS 0.6% chance of exploitation in the next 30 days.

The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-12-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

soflyy:wp_all_import

References

https://wpscan.com/vulnerability/a8d314b9-26ac-4b56-a85c-a2528e55e73a
https://wpscan.com/vulnerability/a8d314b9-26ac-4b56-a85c-a2528e55e73a

Check your stack JSON