Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-all-import
wp-all-import
19 known vulnerabilities on record. Add your version above to see which ones affect you.
Jun 26, 2026Administrator SQL Injection in WP All Import <= 4.0.1 versions.CVE-2026-57628 · affects up to 4.0.1 · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP All Import <= 4.0.1 versions.
Mar 6, 2026WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets: Reflected Cross-Site ScriptingCVE-2026-2830 · affects up to 4.0.0 · reported by WordfenceMedium 6.1
The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filepath’ parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 12, 2025Import any XML, CSV or Excel File to WordPress (WP All Import): Remote Code ExecutionCVE-2025-12733 · affects up to 3.9.6 · reported by WordfenceHigh 8.8
The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2025Import any XML, CSV or Excel File to: Arbitrary file uploadsCVE-2025-10001 · affects up to 3.9.3 · reported by WordfenceHigh 7.2
The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload unsafe files like .phar files on the affected site's server which may make remote code execution possible.
Apr 10, 2024Import any XML or CSV File to: Cross-Site Request Forgery (CSRF)CVE-2024-31939 · affects up to 3.7.3 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Import any XML or CSV File to WordPress.This issue affects Import any XML or CSV File to WordPress: from n/a through 3.7.3.
Jan 22, 2024Import any XML or CSV File to: Accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file typeCVE-2023-7082 · fixed in 3.7.3 · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution.
Nov 7, 2022Import any XML or CSV File to: Is not properly filteringCVE-2022-3418 · fixed in 3.6.9 · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files
Nov 7, 2022Import any XML or CSV File to: Is not validating the paths of files contained in uploaded zip archivesCVE-2022-2711 · fixed in 3.6.9 · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.
Sep 21, 2022Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.CVE-2022-36386 · affects up to 3.6.7 · reported by PatchstackCritical 9.1
Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.
Jul 18, 2022The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, anCVE-2022-1565 · affects up to 3.6.7 · reported by WordfenceHigh 7.2
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.
Jul 4, 2022Import any XML or CSV File to: Accepts all zip files and automatically extracts the zip file without validating the extracted file typeCVE-2022-2268 · fixed in 3.6.8 · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
Dec 6, 2021Import any XML or CSV File to: Does not escape the Import's Title and Unique Identifier fields before outputting them in admin pagesCVE-2021-24714 · fixed in 3.6.3 · reported by WPScanMedium 4.8
The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.
Aug 20, 2019The wp-all-import plugin before 3.4.7 for WordPress has XSS.CVE-2018-20978 · fixed in 3.4.7 · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.7 for WordPress has XSS.
Aug 20, 2019The wp-all-import plugin before 3.4.6 for WordPress has XSS.CVE-2017-18567 · fixed in 3.4.6 · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.6 for WordPress has XSS.
Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · fixed in 3.2.4 · reported by MITREHigh 7.5
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.CVE-2015-9330 · fixed in 3.2.5 · reported by MITRECritical 9.8
The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.CVE-2015-9329 · fixed in 3.2.5 · reported by MITREMedium 6.1
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
Mar 9, 2018WP All Import plugin prior to version 3.4.7 for: Cross-site scriptingCVE-2018-0547 · affects up to 3.4.6 · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Mar 9, 2018WP All Import plugin prior to version 3.4.6 for: Cross-site scriptingCVE-2018-0546 · fixed in 3.4.6 · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.