← Vulnerability feed

Vulnerability record · CVE-2023-4521 · published 25 September 2023

CVE-2023-4521: Mooveagency import xml and rss feeds vulnerability

Mooveagency · Import Xml And Rss Feeds

The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue (https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42) and not deleting the created files when releasing the new version.

9.8 CVSS 3.1 Critical EPSS 41% · top 1.4%
9.8CVSS 3.1 base score
41%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue (https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42) and not deleting the created files when releasing the new version.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://wpscan.com/vulnerability/de2cdb38-3a9f-448e-b564-a798d1e93481 ExploitThird Party Advisory
https://wpscan.com/vulnerability/de2cdb38-3a9f-448e-b564-a798d1e93481 ExploitThird Party Advisory

Track CVE-2023-4521 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2020-24148Mooveagency import xml and rss feeds server-side request forgery (ssrf) vulnerabilityServer-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_rea…EPSS 15%7.2CVE-2023-4300Mooveagency import xml and rss feeds vulnerabilityThe Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malic…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2023-4521), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.