CVE-2025-14478 - Demo Importer Plus <= 2.0.9 - authenticated (author+) blind xml external entity ...

CVE ID : CVE-2025-14478 Published : Jan. 17, 2026, 7:27 a.m. | 1 hour, 1 minute ago Description : The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in vulnerable configurations. This only impacts sites on versions of PHP older than 8.0. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...