{"id":"CVE-2022-3243","aliases":["EUVD-2022-42650","GHSA-5cp7-rvwq-5jc9"],"status":"published","title":"Import all XML, CSV \u0026 TXT into WordPress \u003c 6.5.8 - Admin+ SQLi","description":"The Import all XML, CSV \u0026 TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01328,"percentile":0.71202,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2022-10-17T00:00:00Z","modified":"2026-06-17T04:59:08Z","products":[{"vendor":"smackcoders","product":"import_all_pages\\,_post_types\\,_products\\,_orders\\,_and_users_as_xml_\\\u0026_csv"},{"vendor":"unknown","product":"import all xml, csv \u0026 txt into wordpress"}],"references":[{"url":"https://wpscan.com/vulnerability/9f03bc1a-214f-451a-89fd-2cd3517e8f8a","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3243"},{"url":"https://github.com/advisories/GHSA-5cp7-rvwq-5jc9"}],"sources":{"cve":[{"id":"CVE-2022-3243","title":"Import all XML, CSV \u0026 TXT into WordPress \u003c 6.5.8 - Admin+ SQLi","description":"The Import all XML, CSV \u0026 TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin","status":"published","published":"2022-10-17T00:00:00Z","modified":"2025-05-14T20:17:07.691Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-42650","description":"The Import all XML, CSV \u0026 TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin","status":"published","published":"2022-10-17T00:00:00Z","modified":"2025-05-14T20:17:07Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:47.525663Z"}],"ghsa":[{"id":"GHSA-5cp7-rvwq-5jc9","title":"The Import all XML, CSV \u0026 TXT WordPress plugin before 6.5.8 does not properly sanitise and escape...","description":"The Import all XML, CSV \u0026 TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin","status":"published","published":"2022-10-17T19:00:31Z","modified":"2023-02-02T05:08:17Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:52:42.475291Z"}],"nvd":[{"id":"CVE-2022-3243","description":"The Import all XML, CSV \u0026 TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin","status":"published","published":"2022-10-17T12:15:10.597Z","modified":"2026-06-17T04:59:08.573Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:07:30.6869Z"}]}}