CVE-2018-16255

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.htmlThird Party Advisory
https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharingPermissions Required, Third Party Advisory
https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.htmlThird Party Advisory
https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharingPermissions Required, Third Party Advisory

Timeline

Published: Apr 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-162566.1There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that CVE-2018-162576.1There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is CVE-2018-162586.1There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that th CVE-2018-162596.1There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states CVE-2018-16264.3IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful authentication which c CVE-2018-162616.8In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege Escalation Vulnerability with Dynamic Certificate Tr CVE-2018-162628.8The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security poli CVE-2018-162638.8The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security poli CVE-2018-162646.5The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive information, due to imp CVE-2018-162656.5The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing pr CVE-2018-162668.1The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security CVE-2018-162678.1The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus secur