CVE-2022-3243

Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi

The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin

Affected

Import all XML, CSV & TXT into WordPress

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

1.30% chance of exploitation in the next 30 days, 70th percentile

Published

2022-10-17

Updated

2025-05-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9f03bc1a-214f-451a-89fd-2cd3517e8f8a

References

• CVE Record
• NVD entry