Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · jc-importer
Import WP – Export and Import CSV and XML files to
3 known vulnerabilities on record. Add your version above to see which ones affect you.
Is Import WP – Export and Import CSV and XML files to safe? The full page →
Nov 21, 2025Import WP – Export and Import CSV and XML files to: Sensitive Information ExposureCVE-2025-12894 · affects up to 2.14.17 · reported by WordfenceMedium 5.3
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp.
Nov 1, 2025Import WP – Export and Import CSV and XML files to: Arbitrary File ReadCVE-2025-12137 · affects up to 2.14.16 · reported by WordfenceMedium 4.9
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.14.16. This is due to the plugin's REST API endpoint accepting arbitrary absolute file paths without proper validation in the 'attach_file()' function when handling 'file_local' actions. This makes it possible for authenticated attackers, with administrator-level access and above, to read arbitrary files on the server's filesystem, including sensitive configuration files and system files via the 'local_url' parameter.
Jan 25, 2025Import WP – Export and Import CSV and XML files to: Sensitive Information ExposureCVE-2024-13562 · affects up to 2.14.5 · reported by WordfenceHigh 7.5
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.5 via the uploads directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/ directory which can contain information like imported or local user data and files.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.