{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3919", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-24T12:14:07.599Z", "datePublished": "2025-06-02T22:22:35.834Z", "dateUpdated": "2026-04-08T17:34:03.128Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:03.128Z"}, "affected": [{"vendor": "webtoffee", "product": "Comments Import & Export", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. \r\nThis makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page.\r\nThe vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4"}], "title": "WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bc8863-04a9-4631-9510-624f98ea1e75?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/comments-import-export-woocommerce/trunk/includes/settings/class-hf_cmt_impexpcsv-settings.php?rev=3278076"}, {"url": "https://plugins.trac.wordpress.org/changeset/3288894/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3301183/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "J\u00f6rg Steinstr\u00e4ter"}], "timeline": [{"time": "2025-04-22T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-06-02T10:16:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-03T02:05:25.523678Z", "id": "CVE-2025-3919", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-03T02:05:33.927Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3919", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-03T02:05:25.523678Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-03T02:05:31.052Z"}}], "cna": {"title": "WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "J\u00f6rg Steinstr\u00e4ter"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "webtoffee", "product": "Comments Import & Export", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-22T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-06-02T10:16:48.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bc8863-04a9-4631-9510-624f98ea1e75?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/comments-import-export-woocommerce/trunk/includes/settings/class-hf_cmt_impexpcsv-settings.php?rev=3278076"}, {"url": "https://plugins.trac.wordpress.org/changeset/3288894/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3301183/"}], "descriptions": [{"lang": "en", "value": "The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. \r\nThis makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page.\r\nThe vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:03.128Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3919", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:03.128Z", "dateReserved": "2025-04-24T12:14:07.599Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-02T22:22:35.834Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. \r\nThis makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page.\r\nThe vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4"}, {"lang": "es", "value": "El complemento WordPress Comments Import &amp; Export de WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a la falta de una comprobaci\u00f3n de capacidad en la funci\u00f3n save_settings en todas las versiones hasta la 2.4.3 incluida. Adem\u00e1s, el complemento no depura ni escapa correctamente los par\u00e1metros de configuraci\u00f3n FTP. Esto permite a atacantes autenticados, con acceso de suscriptor o superior, inyectar scripts web arbitrarios en la p\u00e1gina de configuraci\u00f3n del complemento que se ejecutar\u00e1n cada vez que un usuario administrativo acceda a una p\u00e1gina inyectada. La vulnerabilidad se corrigi\u00f3 parcialmente en la versi\u00f3n 2.4.3 y completamente en la versi\u00f3n 2.4.4."}], "id": "CVE-2025-3919", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-06-02T23:15:20.757", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/comments-import-export-woocommerce/trunk/includes/settings/class-hf_cmt_impexpcsv-settings.php?rev=3278076"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3288894/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3301183/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bc8863-04a9-4631-9510-624f98ea1e75?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:28:21.933246+00:00", "value": {"mitigation_remediation": ["Update the WordPress Comments Import & Export plugin to version 2.4.4 or later to apply the official fix.", "Revoke Subscriber-level (or any non\u2011administrative) access from users who do not require it until the plugin is updated.", "Manually review and cleanse the plugin\u2019s settings page, removing any injected scripts or suspicious entries that may have been added before the update.", "Deploy a Web Application Firewall or enable a Content Security Policy that blocks inline scripts to mitigate potential XSS execution until a patch is applied."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting allowing subscribers and higher to inject scripts that execute when an administrator visits the settings page"}, "threat_synthesis": {"affected_systems": "All installations of the webtoffee Comments Import & Export WordPress plugin up to and including version 2.4.3 are vulnerable. Versions 2.4.4 and newer contain the required capability check and parameter sanitization and are not affected.", "description_and_impact": "The Comments Import & Export plugin fails to check the user\u2019s capability on the save_settings function and does not properly sanitize FTP settings parameters. Consequently, any authenticated user with Subscriber-level access or higher can insert arbitrary scripts into the plugin\u2019s settings page. When an administrator later opens that page, the injected scripts run in the administrator\u2019s browser, enabling the attacker to modify data, deface the site, or potentially elevate privileges through additional client\u2011side attacks.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation in the near term. The exploit requires authenticated access with at least Subscriber rights, so the attack surface is limited to sites that allow such roles. The vulnerability is not listed in the CISA KEV catalog, meaning there is no known large\u2011scale exploitation currently reported."}}}}, "created": "2026-04-22T01:30:05.238120+00:00", "updated": "2026-04-22T01:30:05.238131+00:00", "vendors": []}