CVE-2020-24148

Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.

• CWE-918

• https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.mdThird Party Advisory
• https://wordpress.org/plugins/import-xml-feed/#developersRelease Notes, Vendor Advisory
• https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.mdThird Party Advisory
• https://wordpress.org/plugins/import-xml-feed/#developersRelease Notes, Vendor Advisory

Published

Jul 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24142Server-side request forgery in the Video Downloader for TikT…9.8
• CVE-2020-24143Directory traversal in the Video Downloader for TikTok (aka …7.5
• CVE-2020-24144Directory traversal in the Media File Organizer (aka media-f…8.6
• CVE-2020-24145Cross Site Scripting (XSS) vulnerability in the CM Download …6.1
• CVE-2020-24146Directory traversal in the CM Download Manager (aka cm-downl…8.1
• CVE-2020-24147Server-side request forgery (SSR) vulnerability in the WP Sm…9.1
• CVE-2020-24149Server-side request forgery (SSRF) in the Podcast Importer S…7.5
• CVE-2020-24158360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerabil…7.8
• CVE-2020-24159NetEase Youdao Dictionary has a DLL hijacking vulnerability,…7.8
• CVE-2020-24160Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hi…7.8
• CVE-2020-24161Guangzhou NetEase Mail Master 4.14.1.1004 on Windows has a D…7.8
• CVE-2020-24162The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from T…7.8