Soflyy
14 CVEs across 13 Soflyy products. Browse Soflyy vulnerabilities, severities, and proof-of-concept exploits.
Soflyy products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65551 | High | 7.5 | 2026-08-06 | Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdanc… |
CVE-2026-57735 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions. |
CVE-2025-53237 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected X… |
CVE-2026-1582 | Low | 3.7 | 2026-02-18 | The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download end… |
CVE-2025-49038 | High | 7.1 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Dynamic Links wp-dynamic-links allows Reflected… |
CVE-2024-7425 | Medium | 6.8 | 2025-02-07 | The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input… |
CVE-2024-9664 | High | 7.2 | 2025-02-07 | The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted i… |
CVE-2024-9661 | Medium | 4.3 | 2025-02-07 | The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonc… |
CVE-2024-7419 | High | 8.3 | 2025-02-07 | The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. Thi… |
CVE-2024-8722 | Medium | 5.5 | 2025-01-19 | The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, a… |
CVE-2024-9624 | High | 7.6 | 2024-12-17 | The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protect… |
CVE-2024-5331 | Medium | 4.3 | 2024-08-01 | The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it possible for authen… |
CVE-2024-5330 | Medium | 6.4 | 2024-08-01 | The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the breakdance_css_file_paths_cache parameter in all versions up to, and i… |
CVE-2024-31939 | Medium | 4.3 | 2024-04-10 | Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Import any XML or CSV File to WordPress.This issue affects Import any XML or CSV File to WordPress: f… |
CVE-2024-31390 | Critical | 9.9 | 2024-04-03 | : Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Breakdance: from n/a… |
CVE-2024-31380 | Critical | 9.9 | 2024-04-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to p… |
CVE-2023-7082 | High | 7.2 | 2024-01-22 | The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible direct… |
CVE-2023-6938 | Medium | 6.4 | 2024-01-11 | The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insuff… |
CVE-2023-5886 | High | 8.8 | 2023-12-18 | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enoug… |
CVE-2023-5882 | High | 8.8 | 2023-12-18 | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enoug… |
CVE-2023-4724 | High | 7.2 | 2023-12-18 | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_… |
CVE-2022-46841 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Oxygen Builder plugin <= 4.4 versions. |
CVE-2022-3418 | High | 7.2 | 2022-11-07 | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which… |
CVE-2022-2711 | High | 7.2 | 2022-11-07 | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privil… |
CVE-2022-3395 | High | 8.8 | 2022-10-25 | The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing users which has been… |
CVE-2022-3394 | High | 7.2 | 2022-10-25 | The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any lo… |
CVE-2022-36386 | Critical | 9.1 | 2022-09-21 | Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. |
CVE-2022-2268 | High | 7.2 | 2022-07-04 | The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted… |
CVE-2022-1800 | High | 7.2 | 2022-06-13 | The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a d… |
CVE-2021-24714 | Medium | 4.8 | 2021-12-06 | The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin… |
CVE-2018-20978 | Medium | 6.1 | 2019-08-20 | The wp-all-import plugin before 3.4.7 for WordPress has XSS. |
CVE-2017-18567 | Medium | 6.1 | 2019-08-20 | The wp-all-import plugin before 3.4.6 for WordPress has XSS. |
CVE-2015-9331 | High | 7.5 | 2019-08-20 | The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit. |
CVE-2015-9330 | Critical | 9.8 | 2019-08-20 | The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection. |
CVE-2015-9329 | Medium | 6.1 | 2019-08-20 | The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS. |
CVE-2018-16259 | Medium | 6.1 | 2019-04-12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a… |
CVE-2018-16258 | Medium | 6.1 | 2019-04-12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnera… |
CVE-2018-16257 | Medium | 6.1 | 2019-04-12 | There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerabilit… |
CVE-2018-16256 | Medium | 6.1 | 2019-04-12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulne… |
CVE-2018-16255 | Medium | 6.1 | 2019-04-12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All… |
CVE-2018-16254 | Medium | 6.1 | 2019-04-12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All… |
CVE-2018-0547 | Medium | 6.1 | 2018-03-09 | Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via u… |
CVE-2018-0546 | Medium | 6.1 | 2018-03-09 | Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via u… |