CVE-2018-16259

Name: CVE-2018-16259
Creator: NVD / NIST
Published: 2019-04-12T19:29:00.533+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.89%

Last modified Jun 17, 2026

CVE-2018-16259 is a vulnerability of currently unknown severity. There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. EPSS estimates a 0.89% chance of exploitation in the next 30 days.

Description

There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator

Metrics

EPSS Probability

0.89%

54.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-79

Affected Software

Vendor	Product	Versions
Soflyy	Wp All Import	3.4.9

References

https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.htmlThird Party Advisory
https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharingPermissions Required, Third Party Advisory
https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.htmlThird Party Advisory
https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharingPermissions Required, Third Party Advisory

Timeline

Published: Apr 12, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-16259?

How severe is CVE-2018-16259?

Severity scoring for CVE-2018-16259 is pending analysis. The EPSS model estimates a 0.89% probability of exploitation in the next 30 days.

How do I fix CVE-2018-16259?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-16259?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST