Vulnerabilities

TI-2025-04537 CVE-2025-5061 · GHSA-7c74-cfcr-227g

WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 42

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00822 Published 2025-08-05 No fix listed CWE-434

TI-2025-05615 CVE-2025-6207 · GHSA-2grm-wcfh-hhgj

WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 42

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' function in all versions up to, and including, 3.9.28.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00813 Published 2025-08-05 No fix listed CWE-434

TI-2025-02479 CVE-2025-2839 · GHSA-267m-4582-fw66

WP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

LOW 28

The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00285 Published 2025-04-22 No fix listed CWE-79

TI-2024-20684 CVE-2024-31308 · GHSA-x237-rgmj-6rg4

WordPress WP Import Export Lite & WP Import Export plugin <= 3.9.26 - PHP Object Injection vulnerability

LOW 32

Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00404 Published 2024-04-07 No fix listed CWE-502

TI-2022-00172 CVE-2022-0236 · GHSA-r35g-5xjr-p2g3

WP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data Disclosure

MEDIUM 46

The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download foun…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04284 Published 2022-01-18 No fix listed CWE-862