Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

472new WordPress flaws this week

390,714entries in the database

1,460 results · page 13 of 30

Mar 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2754 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument it leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2753 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp of the component LWS File Handler. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-2752 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the component CSM File Handler. The manipulation leads to out-of-bounds read. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 25, 2025A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-2751 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 25, 2025A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2750 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation leads to out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 22, 2025Export and Import Users and Customers: Path TraversalCVE-2025-1973 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
Product
Export and Import Users and Customers
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Export and Import Users and Customers: Arbitrary file deletionCVE-2025-1972 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Product
Export and Import Users and Customers
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Export and Import Users and Customers: PHP Object InjectionCVE-2025-1971 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Export and Import Users and Customers
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Export and Import Users and Customers: Server-Side Request ForgeryCVE-2025-1970 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Export and Import Users and Customers
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2025A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2592 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 21, 2025A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2591 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. It is recommended to apply a patch to fix this issue.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 20, 2025Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URCVE-2025-27888 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.8
Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid. This issue affects all previous Druid versions. When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected. Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.
Product
Apache Druid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Mar 20, 2025Order Export & Order Import for WooCommerce: Server-Side Request ForgeryCVE-2024-13923 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.0 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Order Export & Order Import for WooCommerce: Arbitrary file deletionCVE-2024-13922 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Order Export & Order Import for WooCommerce: PHP Object InjectionCVE-2024-13921 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.0 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Order Export & Order Import for WooCommerce: Directory TraversalCVE-2024-13920 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.0 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service.CVE-2024-7768 · Other software · h2oai · reported by security@huntr.devHigh 7.5
A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
Product
h2oai/h2o-3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com
Mar 19, 2025In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, CVE-2025-30258 · Other software · GnuPG · reported by MITRELow 2.7
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
Product
GnuPG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dev.gnupg.org dev.gnupg.org
Mar 10, 2025A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2152 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2025A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2151 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 7, 2025XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance.CVE-2025-27604 · Websites & servers · xwikisas · reported by GitHubHigh 7.5
XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.
Product
application-confluence-migrator-pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 7, 2025XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance.CVE-2025-27603 · Websites & servers · xwikisas · reported by GitHubCritical 9.1
XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0.
Product
application-confluence-migrator-pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 5, 2025The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalatioCVE-2024-13232 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalation due to a missing capability check on the renderImport() function in all versions up to, and including, 4.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary SQL statements that can leveraged to create a new administrative user account.
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 3, 2025A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript iCVE-2024-53384 · Other software · Egoist · reported by MITREMedium 5.1
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs_shims.js components
Product
Tsup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Mar 3, 2025DB Tables Import/Export: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27271 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberto Cocchiara DB Tables Import/Export db-tables-importexport allows Reflected XSS.This issue affects DB Tables Import/Export: from n/a through <= 1.0.1.
Product
DB Tables Import/Export
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update DB Tables Import/Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025DsgnWrks Twitter Importer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23762 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Sternberg DsgnWrks Twitter Importer dsgnwrks-twitter-importer allows Reflected XSS.This issue affects DsgnWrks Twitter Importer: from n/a through <= 1.1.4.
Product
DsgnWrks Twitter Importer
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update DsgnWrks Twitter Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T2 Macs On Apple T2 Macs, when LCVE-2022-49357 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T2 Macs On Apple T2 Macs, when Linux attempts to read the db and dbx efi variables at early boot to load UEFI Secure Boot certificates, a page fault occurs in Apple firmware code and EFI runtime services are disabled with the following logs: [Firmware Bug]: Page fault caused by firmware at PA: 0xffffb1edc0068000 WARNING: CPU: 3 PID: 104 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x50/0xf0 (Removed some logs from here) Call Trace: <TASK> page_fault_oops+0x4f/0x2c0 ? search_bpf_extables+0x6b/0x80 ? search_module_extables+0x50/0x80 ? search_exception_tables+0x5b/0x60 kernelmode_fixup_or_oops+0x9e/0x110 __bad_area_nosemaphore+0x155/0x190 bad_area_nosemaphore+0x16/0x20 do_kern_addr_fault+0x8c/0xa0 exc_page_fault+0xd8/0x180 asm_exc_page_fault+0x1e/0x30 (Removed some logs from here) ? __efi_call+0x28/0x30 ? switch_mm+0x20/0x30 ? efi_call_rts+0x19a/0x8e0 ? process_one_work+0x222/0x3f0 ? worker_thread+0x4a/0x3d0 ? kthread+0x17a/0x1a0 ? process_one_work+0x3f0/0x3f0 ? set_kthread_struct+0x40/0x40 ? ret_from_fork+0x22
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 24, 2025Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which alCVE-2025-25279 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comCritical 9.9
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Feb 21, 2025Mambo Importer: PHP Object InjectionCVE-2024-13899 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted input via the $data parameter in the fImportMenu function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Mambo Importer
Affected
up to 1.0
What to do
Affects up to 1.0. Update Mambo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2025A memory leak has been identified in the parseSWF_IMPORTASSETS2 function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of serviceCVE-2025-26307 · Other software · Libming · reported by MITREMedium 6.5
A memory leak has been identified in the parseSWF_IMPORTASSETS2 function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file.
Product
Libming
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 18, 2025Easy MLS Listings Import: Stored Cross-Site ScriptingCVE-2024-12525 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy MLS Listings Import
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Easy MLS Listings Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 13, 2025Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.CVE-2023-34402 · Other software · Mercedes-benz · reported by MITREHigh 7.7
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside file is encapsulate another file, which service will drop during processing. Due to missed checks, attacker can achieve Arbitrary File Write with service speech rights.
Product
Headunit Ntg6 Mercedes-benz User Experience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securelist.com
Feb 13, 2025Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.CVE-2023-34401 · Other software · Mercedes-benz · reported by MITRELow 3.7
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside profile folder there is a file, which is encoded with proprietary UD2 codec. Due to missed size checks in the enapsulate file, attacker can achieve Out-of-Bound Read in heap memory.
Product
Headunit Ntg6 Mercedes-benz User Experience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securelist.com
Feb 13, 2025Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.CVE-2023-34400 · Other software · Mercedes-benz · reported by MITREHigh 7.5
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. In case of parsing file, service try to define header inside the file and convert it to null-terminated string. If character is missed, will return null pointer.
Product
Headunit Ntg6 Mercedes-benz User Experience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securelist.com
Feb 13, 2025Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.CVE-2023-34399 · Other software · Mercedes-benz · reported by MITRECritical 9.8
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The version of boost library contains vulnerability integer overflow.
Product
Headunit Ntg6 Mercedes-benz User Experience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securelist.com
Feb 13, 2025Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.CVE-2023-34398 · Other software · Mercedes-benz · reported by MITREHigh 7.5
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The boost library contains a vulnerability/null pointer dereference.
Product
Headunit Ntg6 Mercedes-benz User Experience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securelist.com
Feb 13, 2025Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB.CVE-2023-34397 · Other software · Mercedes-benz · reported by MITREHigh 7.5
Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB. During parsing you can trigger that the service will be crashed.
Product
Headunit Ntg6 Mercedes-benz User Experience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securelist.com
Feb 11, 2025In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file.CVE-2025-0525 · Other software · Octopus Deploy · reported by security@octopus.comLow 2.3
In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could provide an adversary with information that may aid in further attacks against the server.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com
Feb 7, 2025An error when handling authorization related to the import / export interfaces on the RISC Platform prior to the saas-2021-12-29 release can potentially be explCVE-2021-41528 · Other software · Flexera · reported by PSIRT-CNA@flexerasoftware.comMedium 5.3
An error when handling authorization related to the import / export interfaces on the RISC Platform prior to the saas-2021-12-29 release can potentially be exploited to access the import / export functionality with low privileges.
Product
RISC Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.flexera.com medium.com
Feb 7, 2025WP All Import Pro: PHP Object InjectionCVE-2024-9664 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted input from an import file. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
WP All Import Pro
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Feb 7, 2025WP All Import Pro: Cross-Site Request ForgeryCVE-2024-9661 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported content (posts, comments, users, etc.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP All Import Pro
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Feb 3, 2025Import Excel to Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24629 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpgear Import Excel to Gravity Forms gf-excel-import allows Reflected XSS.This issue affects Import Excel to Gravity Forms: from n/a through <= 1.18.
Product
Import Excel to Gravity Forms
Affected
up to 1.18
What to do
Affects up to 1.18. Update Import Excel to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Catalog Importer, Scraper & Crawler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22775 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in idiatech Catalog Importer, Scraper & Crawler intelligent-importer allows Reflected XSS.This issue affects Catalog Importer, Scraper & Crawler: from n/a through <= 5.1.3.
Product
Catalog Importer, Scraper & Crawler
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update Catalog Importer, Scraper & Crawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 30, 2025Software installed and run as a non-privileged user may conduct improper read/write operations on imported/exported DMA buffers.CVE-2024-46974 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 7.8
Software installed and run as a non-privileged user may conduct improper read/write operations on imported/exported DMA buffers.
Product
Graphics DDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record imaginationtech.com
Jan 27, 2025An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticatedCVE-2022-31749 · Network & remote access · WatchGuard · reported by cve@rapid7.comMedium 6.5
An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations on WatchGuard Firebox and XTM appliances
Product
Fireware OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rapid7.com watchguard.com
Jan 27, 2025Import and export users and customers: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-24689 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Retrieve Embedded Sensitive Data.This issue affects Import and export users and customers: from n/a through <= 1.27.12.
Product
Import and export users and customers
Affected
up to 1.27.12
What to do
Affects up to 1.27.12. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 25, 2025Import WP – Export and Import CSV and XML files to: Sensitive Information ExposureCVE-2024-13562 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.5 via the uploads directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/ directory which can contain information like imported or local user data and files.
Product
Import WP – Export and Import CSV and XML files to
Affected
up to 2.14.5
What to do
Affects up to 2.14.5. Update Import WP – Export and Import CSV and XML files to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 25, 2025Etsy Importer: Stored Cross-Site ScriptingCVE-2024-12817 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Etsy Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_link' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Etsy Importer
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Etsy Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 23, 2025Save & Import Image from URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23960 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in basteln3rk Save & Import Image from URL save-import-image-from-url allows Reflected XSS.This issue affects Save & Import Image from URL: from n/a through <= 0.7.
Product
Save & Import Image from URL
Affected
up to 0.7
What to do
Affects up to 0.7. Update Save & Import Image from URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WM Options Import Export: Insertion of Sensitive Information Into Sent DataCVE-2025-23781 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Web Mumbai WM Options Import Export wm-options-import-export allows Retrieve Embedded Sensitive Data.This issue affects WM Options Import Export: from n/a through <= 1.0.1.
Product
WM Options Import Export
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WM Options Import Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.