wpallimport vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20252
3. 20261

Newest CVEs

• CVE-2026-2830

  WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'

  wpallimport · WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

  Medium6.1
• CVE-2025-12733

  Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic

  wpallimport · WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

  High8.8
• CVE-2025-10001

  Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload

  wpallimport · WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

  High7.2
• CVE-2022-1565

  Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload

  wpallimport · WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

  High7.2