GCVE - cpe:2.3:a:unknown:export_all_urls:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:export_all_urls:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Export All Urls (`b63e8793-a917-5984-b842-9f9b3a413b77`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-2696`	vulnerable	2026-06-08 07:55:17.395767	Export All URLs < 5.1 - Unauthenticated Sensitive Data Exposure The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/uploads/ directory. As a result, any unauthenticated user can brute-force the filenames to gain access to sensitive data contained within the exported files. Published: 2026-04-01T06:00:08.236Z Updated: 2026-04-01T14:02:38.139Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/55d627c1-ad05-4cd1-ae7b-932d84c19313/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-3118`	vulnerable	2026-06-08 06:09:38.592886	Export All URLs < 4.6 - Reflected XSS The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Published: 2023-07-10T12:40:46.857Z Updated: 2025-04-23T16:20:39.517Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/8a9efc8d-561a-42c6-8e61-ae5c3be581ea	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-2638`	vulnerable	2026-06-08 05:43:35.938915	Export All URLs < 4.4 - Admin+ Arbitrary System File Removal The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server Published: 2022-08-29T17:15:37.000Z Updated: 2024-08-03T00:46:03.231Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/70840a72-ccdc-4eee-9ad2-874809e5de11	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0914`	vulnerable	2026-06-08 05:39:11.470027	Export All URLs < 4.3 - Private/Draft Post/Page Title Disclosure via CSRF The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example Published: 2022-04-11T14:40:55.000Z Updated: 2024-08-02T23:47:43.207Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/c328be28-75dd-43db-a5b9-c1ba0636c930	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0892`	vulnerable	2026-06-08 05:39:11.425820	Export All URLs < 4.2 - Reflected Cross-Site Scripting The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting Published: 2022-04-11T14:40:53.000Z Updated: 2024-08-02T23:47:42.091Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/e5d95261-a243-493f-be6a-3c15ccb65435	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.