SO
Vendor
Soflyy
51
CVEs
0
On KEV
0
New 30D
Products
WA9.8
WP All Import
Soflyy
19 CVEs0 on KEV0 new
WA8.8
WP All Export
Soflyy
7 CVEs0 on KEV0 new
BR9.9
Breakdance
Soflyy
5 CVEs0 on KEV0 new
EA8.8
Export Any Wordpress Data TO Xml/csv
Soflyy
5 CVEs0 on KEV0 new
OX9.9
Oxygen
Soflyy
4 CVEs0 on KEV0 new
WA7.6
WP All Import Pro
Soflyy
4 CVEs0 on KEV0 new
OB9.9
Oxygen Builder
Soflyy
2 CVEs0 on KEV0 new
IA4.3
Import any XML or CSV File to WordPress
Soflyy
1 CVEs0 on KEV0 new
IA7.2
Import any XML or CSV File to WordPress (WordPress plugin)
Soflyy
1 CVEs0 on KEV0 new
WA3.7
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel
soflyy
1 CVEs0 on KEV0 new
WD7.1
WP Dynamic Links
Soflyy
1 CVEs0 on KEV0 new
WW7.1
WP Wizard Cloak
Soflyy
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-65551 | BR Breakdance Soflyy | 7.5 | Aug 6 | WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability |
| CVE-2026-57735 | BR Breakdance Soflyy | 7.1 | Jul 23 | WordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-53237 | WW WP Wizard Cloak Soflyy | 7.1 | Feb 20 | WordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability |
| CVE-2026-1582 | WA WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel soflyy | 3.7 | Feb 18 | WP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling |
| CVE-2025-49038 | WD WP Dynamic Links Soflyy | 7.1 | Aug 14 | WordPress WP Dynamic Links plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability |
| CVE-2024-7425 | WA WP All Export Soflyy | 7.2 | Feb 7 | WP All Export Pro <= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update |
| CVE-2024-9661 | WA WP All Import Pro Soflyy | 4.3 | Feb 7 | WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion |
| CVE-2024-7419 | WA WP All Export Soflyy | 8.8 | Feb 7 | WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields |
| CVE-2024-9664 | WA WP All Import Pro Soflyy | 7.2 | Feb 7 | WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File |
| CVE-2024-8722 | WA WP All Import Pro Soflyy | 5.5 | Jan 19 | WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload |
| CVE-2024-9624 | WA WP All Import Pro Soflyy | 7.6 | Dec 17 | WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import |
| CVE-2024-5331 | BR Breakdance Soflyy | 4.3 | Aug 1 | Breakdance <= 1.7.2 - Missing Authorization |
| CVE-2024-5330 | BR Breakdance Soflyy | 5.4 | Aug 1 | Breakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-4662 | OX Oxygen Soflyy | 8.8 | May 23 | Oxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code Execution |
| CVE-2024-31939 | IA Import any XML or CSV File to WordPress Soflyy | 4.3 | Apr 10 | WordPress Import any XML or CSV File to WordPress plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-31380 | OB Oxygen Builder Soflyy | 9.9 | Apr 3 | WordPress Oxygen plugin <= 4.9 - Authenticated Remote Code Execution (RCE) vulnerability |
| CVE-2024-31390 | BR Breakdance Soflyy | 9.9 | Apr 3 | WordPress Breakdance plugin <= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability |
| CVE-2023-7082 | EA Export Any Wordpress Data TO Xml/csv Soflyy | 7.2 | Jan 22 | WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE |
| CVE-2023-6938 | OX Oxygen Soflyy | 5.4 | Jan 11 | Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field |
| CVE-2023-5882 | WA WP All Export Soflyy | 8.8 | Dec 18 | WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF |
| CVE-2023-4724 | EA Export Any Wordpress Data TO Xml/csv Soflyy | 7.2 | Dec 18 | WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE |
| CVE-2023-5886 | EA Export Any Wordpress Data TO Xml/csv Soflyy | 8.8 | Dec 18 | WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF |
| CVE-2022-46841 | OB Oxygen Builder Soflyy | 8.8 | Oct 3 | WordPress Oxygen Builder Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF) |
| CVE-2022-3418 | WA WP All Import Soflyy | 7.2 | Nov 7 | WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE |
| CVE-2022-2711 | WA WP All Import Soflyy | 7.2 | Nov 7 | WP All Import < 3.6.9 - Admin+ Directory traversal via file upload |
| CVE-2022-3394 | WA WP All Export Soflyy | 7.2 | Oct 25 | WP All Export Pro < 1.7.9 - Authenticated Code Injection |
| CVE-2022-3395 | WA WP All Export Soflyy | 8.8 | Oct 25 | WP All Export Pro < 1.7.9 - Authenticated SQLi |
| CVE-2022-36386 | IA Import any XML or CSV File to WordPress (WordPress plugin) Soflyy | 7.2 | Sep 21 | WordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerability |
| CVE-2022-2268 | WA WP All Import Soflyy | 7.2 | Jul 4 | WP All Import < 3.6.8 - Admin+ Arbitrary File Upload |
| CVE-2022-1800 | EA Export Any Wordpress Data TO Xml/csv Soflyy | 7.2 | Jun 13 | Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection |
| CVE-2021-24714 | WA WP All Import Soflyy | 4.8 | Dec 6 | The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could… |
| CVE-2018-20978 | WA WP All Import Soflyy | 6.1 | Aug 20 | The wp-all-import plugin before 3.4.7 for WordPress has XSS |
| CVE-2017-18567 | WA WP All Import Soflyy | 6.1 | Aug 20 | The wp-all-import plugin before 3.4.6 for WordPress has XSS |
| CVE-2015-9331 | WA WP All Import Soflyy | 7.5 | Aug 20 | The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit |
| CVE-2015-9330 | WA WP All Import Soflyy | 9.8 | Aug 20 | The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection |
| CVE-2015-9329 | WA WP All Import Soflyy | 6.1 | Aug 20 | The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS |
| CVE-2018-16259 | WA WP All Import Soflyy | 6.1 | Apr 12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit |
| CVE-2018-16258 | WA WP All Import Soflyy | 6.1 | Apr 12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type |
| CVE-2018-16257 | WA WP All Import Soflyy | 6.1 | Apr 12 | There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template |
| CVE-2018-16256 | WA WP All Import Soflyy | 6.1 | Apr 12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule) |
| CVE-2018-16255 | WA WP All Import Soflyy | 6.1 | Apr 12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate |
| CVE-2018-16254 | WA WP All Import Soflyy | 6.1 | Apr 12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options |
| CVE-2018-0547 | WA WP All Import Soflyy | 6.1 | Mar 9 | Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors |
| CVE-2018-0546 | WA WP All Import Soflyy | 6.1 | Mar 9 | Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors |