{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T21:15:01.168","vulnerabilities":[{"cve":{"id":"CVE-2025-3919","sourceIdentifier":"security@wordfence.com","published":"2025-06-02T23:15:20.757","lastModified":"2026-06-17T09:20:55.733","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. \r\nThis makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page.\r\nThe vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4"},{"lang":"es","value":"El complemento WordPress Comments Import & Export de WordPress es vulnerable a la modificación no autorizada de datos debido a la falta de una comprobación de capacidad en la función save_settings en todas las versiones hasta la 2.4.3 incluida. Además, el complemento no depura ni escapa correctamente los parámetros de configuración FTP. Esto permite a atacantes autenticados, con acceso de suscriptor o superior, inyectar scripts web arbitrarios en la página de configuración del complemento que se ejecutarán cada vez que un usuario administrativo acceda a una página inyectada. La vulnerabilidad se corrigió parcialmente en la versión 2.4.3 y completamente en la versión 2.4.4."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"webtoffee","product":"Comments Import & Export","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-06-03T02:05:25.523678Z","id":"CVE-2025-3919","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/comments-import-export-woocommerce/trunk/includes/settings/class-hf_cmt_impexpcsv-settings.php?rev=3278076","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3288894/","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3301183/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bc8863-04a9-4631-9510-624f98ea1e75?source=cve","source":"security@wordfence.com"}]}}]}