Atlasgondal maintains a narrowly scoped product portfolio centered on its Export All URLs tool, a web-based utility that exhibits a durable pattern of application-layer input-handling and access-control weaknesses. The recurring vulnerability classes—cross-site scripting, cross-site request forgery, improper file-path handling, and externally controlled resource references—reflect typical risks in web applications where user input flows through page generation and file operations without adequate sanitization and validation. Current severity, exploitation status, and exposure metrics are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Atlasgondal over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-51510HIGH Cross-Site Request Forgery (CSRF) vulnerability in Atlas Gondal Export Media URLs.This issue affects Export Media URLs: from n/a through 1.0. | Mar 16, 2024 | 8.8 | 24 | NO | NO |
CVE-2023-3118MEDIUM The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which | Jul 10, 2023 | 6.1 | 20 | NO | NO |
CVE-2022-27856MEDIUM Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Atlas Gondal Export All URLs plugin <= 4.1 versions. | May 10, 2023 | 5.4 | 19 | NO | NO |
CVE-2022-29452MEDIUM Authenticated (editor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Export All URLs plugin <= 4.1 at WordPress. | Jun 15, 2022 | 4.8 | 19 | NO | NO |
CVE-2022-2638MEDIUM The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privi | Aug 29, 2022 | 6.5 | 17 | NO | NO |
CVE-2022-0914MEDIUM The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (i | Apr 11, 2022 | 6.5 | 17 | NO | NO |
CVE-2022-0892MEDIUM The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting | Apr 11, 2022 | 6.1 | 17 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Atlasgondal.
Media articles that mention a CVE ID that affects a product developed by Atlasgondal — matched by CVE ID, not by vendor name.