Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: WP Ultimate CSV Importer 9.2 Clear all filters
TI-2026-67428 CVE-2026-80518 · GHSA-w4w7-6vj3-3c3v

WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path

Priority LOW 17

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00178 Published 2026-10-03 Fixed in 9.2 CWE-200
TI-2026-67427 CVE-2026-80517 · GHSA-4qqx-23c4-hcqv

WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload

Priority LOW 16

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing h…

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00142 Published 2026-10-03 Fixed in 9.2 CWE-79