title: Import CSV Files <= 1.0 - Reflected Cross-Site Scripting
description: The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check when performing such action as well, resulting in a Reflected Cross-Site Scripting
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
vendor: Unknown
product: Import CSV Files
versions:
status: affected, versionType: custom, version: 0, lessThanOrEqual: 1.0
defaultStatus: affected
collectionURL: https://wordpress.org/plugins
}