TI-2026-41454 CVE-2026-57628 · GHSA-mf27-wm76-5323
WordPress WP All Import plugin <= 4.0.1 - SQL Injection vulnerability
Priority LOW 33
Administrator SQL Injection in WP All Import <= 4.0.1 versions.
Vulnerabilities
8 records
TI-2026-02430 CVE-2026-2830 · GHSA-9rhw-f499-jxmh
WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'
Priority LOW 27
The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filepath’ parameter in all versions up to, and including, 4.0.0 due…
TI-2025-11669 CVE-2025-12733 · GHSA-4q3g-58h7-p7pq
Code injection in WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
Priority MEDIUM 41
The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6.
TI-2025-09180 CVE-2025-10001 · GHSA-q6c6-gcgm-pxf7
Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload
Priority LOW 34
The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3.
TI-2024-06881 CVE-2024-7425 · GHSA-xq2h-7fp3-456v
WP All Export Pro <= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update
Priority LOW 34
The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input validation and sanitization in all versions up to, and includ…
TI-2024-06875 CVE-2024-7419 · GHSA-q366-9pf7-w4g2
WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields
Priority MEDIUM 41
The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields.
TI-2024-21326 CVE-2024-32431 · GHSA-m6cw-2mrx-vm24
WordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection
Priority LOW 32
Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2.
TI-2022-01436 CVE-2022-1565 · GHSA-ggqc-76h3-jpv2
Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
Priority MEDIUM 50
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7.