CVE-2021-24714: The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege

medium Affects wp-all-import (WordPress plugin). Feed 2026.10.29.4, updated 2026-10-29; published 2021-12-06; advisory modified 2026-06-17.

The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege

Package: wp-all-import (WordPress plugin) WordPress
Affected versions: <3.6.3
Fixed in: 3.6.3
Severity: medium CVSS 4.8
Exploitation: not on CISA KEV · EPSS 1% (49.5th percentile)
Published: 2021-12-06
Source: nvd

References

CWE-79

NVD record wp-all-import (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2022-2711 high The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the path same package: wp-all-import (WordPress plugin)
CVE-2015-9330 critical The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection. same package: wp-all-import (WordPress plugin)
CVE-2022-36386 critical Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File same package: wp-all-import (WordPress plugin)
CVE-2018-0546 medium Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for Word same package: wp-all-import (WordPress plugin)
CVE-2018-0547 medium Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for Word same package: wp-all-import (WordPress plugin)
CVE-2015-9331 high The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated r same package: wp-all-import (WordPress plugin)