Kraftplugins Demo Importer Plus

• CVE-2025-14478 High 7.5 Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload 0.4%
• CVE-2025-14364 High 8.8 Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation 0.4%
• CVE-2025-13066 High 8.8 Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass 0.6%
• CVE-2024-9172 Medium 6.4 Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload 0.3%