Is my WordPress plugin safe?

• Sep 17, 2026Comments Import & Export: Does not restrict its comment export to users able to moderate commentsCVE-2026-87836 · fixed in 2.5.4 · reported by WPScanLow 2.7

  The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.

  NVD recordwpscan.com

• Mar 25, 2026Comments Import & Export: Missing AuthorizationCVE-2026-32441 · affects up to 2.4.9 · reported by PatchstackHigh 7.7

  Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through <= 2.4.9.

  NVD recordpatchstack.com

• Jun 2, 2025WordPress Comments Import & Export: Unauthorized modification of dataCVE-2025-3919 · affects up to 2.4.3 · fixed in 2.4.3 · reported by WordfenceMedium 6.4

  The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page. The vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 11, 2024WordPress Comments Import & Export: To arbitrary file readCVE-2024-7514 · affects up to 2.3.7 · fixed in 2.3.8 · reported by WordfenceMedium 6.5

  The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments import process, in versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The issue was partially fixed in version 2.3.8 and fully fixed in 2.3.9

  NVD recordplugins.trac.wordpress.orgwordfence.com

• Apr 12, 2024WordPress Comments Import & Export: Cross-Site Request Forgery (CSRF)CVE-2024-31235 · affects up to 2.3.5 · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.5.

  NVD recordpatchstack.compatchstack.com

• Nov 7, 2023WordPress Comments Import & Export: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45370 · affects up to 2.3.1 · reported by PatchstackMedium 6.1

  Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.

  NVD recordpatchstack.compatchstack.com

• Jun 19, 2018The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.CVE-2018-11526 · affects up to 2.0.4 · reported by MITREHigh 7.8

  The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.

  NVD recordwordpress.orgwpvulndb.com

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.