All 5 CVE vulnerabilities found in Demo Importer Plus, with AI-generated Chinese analysis, references, and POCs.
Vendor: kraftplugins
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2025-14478 | Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload CWE-611 | 7.5 | High | 2026-01-17 |
| CVE-2025-69091 | WordPress Demo Importer Plus plugin <= 2.0.8 - Broken Access Control vulnerability CWE-862 | 4.3 | Medium | 2025-12-30 |
| CVE-2025-14364 | Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation CWE-862 | 8.8 | High | 2025-12-18 |
| CVE-2025-13066 | Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass CWE-434 | 8.8 | High | 2025-12-05 |
| CVE-2024-9172 | Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CWE-79 | 6.4 | Medium | 2024-10-02 |
All 5 known CVE vulnerabilities affecting Demo Importer Plus with full Chinese analysis, references, and POCs where available.