Skip to content
OpenAdvisories

Vendor

kraftplugins

9 known vulnerabilities.

Products

Demo Importer Plus 4 Mega Elements – Addons for Elementor 2 Mega Elements 2 Wheel of Life: Coaching and Assessment Tool for Life Coach 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2025-14478

    Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload

    The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access an…

    kraftplugins Demo Importer Plus Web / CMS
  • High 8.8
    CVE-2025-14364 Public exploit

    Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation

    The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2.0.8. This m…

    kraftplugins Demo Importer Plus Web / CMS
  • High 8.8
    CVE-2025-13066

    Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass

    The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while …

    kraftplugins Demo Importer Plus Web / CMS