Vulnerabilities

TI-2026-09835 CVE-2026-11397 · GHSA-w7wg-w2g9-vmjq

WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter

LOW 25

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpie_import_upload_file_from_url AJAX action.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00385 Published 2026-07-03 No fix listed CWE-918

TI-2025-04537 CVE-2025-5061 · GHSA-7c74-cfcr-227g

WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 42

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00822 Published 2025-08-05 No fix listed CWE-434

TI-2025-05615 CVE-2025-6207 · GHSA-2grm-wcfh-hhgj

WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 42

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' function in all versions up to, and including, 3.9.28.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00813 Published 2025-08-05 No fix listed CWE-434

TI-2025-02479 CVE-2025-2839 · GHSA-267m-4582-fw66

WP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

LOW 28

The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00285 Published 2025-04-22 No fix listed CWE-79

TI-2024-20684 CVE-2024-31308 · GHSA-x237-rgmj-6rg4

WordPress WP Import Export Lite & WP Import Export plugin <= 3.9.26 - PHP Object Injection vulnerability

LOW 32

Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00404 Published 2024-04-07 No fix listed CWE-502

TI-2023-25825 CVE-2023-47687 · GHSA-4q3r-rvm6-j4mp

WordPress Woo Custom and Sequential Order Number Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in VJInfotech Woo Custom and Sequential Order Number plugin <= 2.6.0 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00277 Published 2023-11-16 No fix listed CWE-352

TI-2022-00172 CVE-2022-0236 · GHSA-r35g-5xjr-p2g3

WP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data Disclosure

MEDIUM 46

The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download foun…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04284 Published 2022-01-18 No fix listed CWE-862