CVE-2022-3243

HIGH 7.2CVE-2022-3243 · Published 17/10/2022 · updated 17/06/2026

In short

CVE-2022-3243 is a HIGH (CVSS 7.2) vulnerability affecting import all pages, post types, products, orders, and users as xml & csv (smackcoders).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.4% of all vulnerabilities.
Fix: update to 6.5.8 or later.

Package	Affected versions	Patched versions
import all pages, post types, products, orders, and users as xml & csv smackcoders	`< 6.5.8`	`6.5.8`

Description

The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin

References

wpscan.com/vulnerability/9f03bc1a-214f-451a-89fd-2cd3517e8f8a · Exploit

More vulnerabilities in import all pages, post types, products, orders, and users as xml & csv

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

import all pages, post types, products, orders, and users as xml & csv

smackcoders

< 6.5.8

6.5.8

More vulnerabilities in import all pages, post types, products, orders, and users as xml & csv

See all →