Demo Importer Plus
Approved changes feed: RSS · Atom
cpe:2.3:a:kraftplugins:demo_importer_plus:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Kraftplugins (bd8ffecd-a4dd-5b95-92ee-a12c2e04763d) |
|---|---|
| Product | Demo Importer Plus (cc7e0fc5-e5b3-5453-8dc2-d93ee6a681e0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-14478 |
vulnerable | 2026-06-08 07:06:34.542117 |
Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload
HIGH (7.5)
The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in vulnerable configurations. This only impacts sites on versions of PHP older than 8.0.
Published: 2026-01-17T07:27:37.627Z
Updated: 2026-04-08T17:16:27.643Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14364 |
vulnerable | 2026-06-08 07:06:34.358105 |
Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation
HIGH (8.8)
The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full site reset, dropping all database tables except users/usermeta and re-running wp_install(), which also assigns the Administrator role to the attacking subscriber account.
Published: 2025-12-18T09:21:30.392Z
Updated: 2026-04-08T17:35:21.722Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13066 |
vulnerable | 2026-06-08 07:04:31.519465 |
Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
HIGH (8.8)
The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Published: 2025-12-05T03:28:36.875Z
Updated: 2026-04-08T17:02:59.512Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9172 |
vulnerable | 2026-06-08 07:00:26.843740 |
Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
MEDIUM (6.4)
The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Published: 2024-10-02T07:35:26.640Z
Updated: 2026-04-08T16:50:00.734Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.