Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-ultimate-csv-importer
WP Ultimate CSV Importer
21 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 10, 2026Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.CVE-2026-45440 · affects up to 9.2 · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.
Oct 3, 2026WP Ultimate CSV Importer: Does not use a site-specific secretCVE-2026-80518 · fixed in 9.2 · reported by WPScanLow 3.7
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file.
Oct 3, 2026WP Ultimate CSV Importer: Does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served locationCVE-2026-80517 · fixed in 9.2 · reported by WPScanLow 3.5
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.
Oct 1, 2026WP Ultimate CSV Importer: Insertion of Sensitive Information Into Sent DataCVE-2026-103336 · affects up to 9.1 · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1.
Aug 29, 2026WP Ultimate CSV Importer: Does not properly sanitise and escape imported field values before using them in a SQL statementCVE-2026-80488 · fixed in 9.0 · reported by WPScanMedium 4.1
The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
Jul 11, 2026WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel: Remote Code ExecutionCVE-2026-13353 · affects up to 8.0.1 · reported by WordfenceHigh 8.8
The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capability checks on the AJAX handlers for install_addon, saveMappedFields, and StartImport, combined with the plugin nonce being exposed to any authenticated user who can load an admin page, allowing a Subscriber to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in the MappedFields parameter, and trigger evaluation via eval() in ImportHelpers::get_meta_values(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026WP Import – Ultimate CSV XML Importer for: SQL InjectionCVE-2026-1317 · affects up to 7.37 · reported by WordfenceMedium 6.5
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is due to insufficient escaping on the `file_name` parameter which is stored in the database during file upload and later used in raw SQL queries without proper sanitization. This makes it possible for authenticated attackers with Subscriber-level access or higher to append additional SQL queries into already existing queries via a malicious filename, which can be used to extract sensitive information from the database. The vulnerability can only be exploited when the 'Single Import/Export' option is enabled, and the server is running a PHP version < 8.0.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 1, 2026WP Import – Ultimate CSV XML Importer for: Server-Side Request ForgeryCVE-2025-14627 · affects up to 7.35 · reported by WordfenceMedium 6.4
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.35. This is due to inadequate validation of the resolved URL after following Bitly shortlink redirects in the `upload_function()` method. While the initial URL is validated using `wp_http_validate_url()`, when a Bitly shortlink is detected, the `unshorten_bitly_url()` function follows redirects to the final destination URL without re-validating it. This makes it possible for authenticated attackers with Contributor-level access or higher to make the server perform HTTP requests to arbitrary internal endpoints, including localhost, private IP ranges, and cloud metadata services (e.g., 169.254.169.254), potentially exposing sensitive internal data.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2025WP Import – Ultimate CSV XML Importer for: PHP Object InjectionCVE-2025-13145 · affects up to 7.33.1 · reported by WordfenceHigh 7.2
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. This is due to deserialization of untrusted data supplied via CSV file imports in the import_single_post_as_csv function within SingleImportExport.php. This makes it possible for authenticated attackers, with administrator-level access or higher, to inject a PHP object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 12, 2025WP Import – Ultimate CSV XML Importer for: Unauthorized access of sensitive informationCVE-2025-12732 · affects up to 7.33 · reported by WordfenceMedium 4.3
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting() function in all versions up to, and including, 7.33. This makes it possible for authenticated attackers, with Author-level access or higher, to extract sensitive information including OpenAI API keys configured through the plugin's admin interface.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2025WP Import – Ultimate CSV XML Importer for: Arbitrary file deletionCVE-2025-10058 · affects up to 7.27 · reported by WordfenceHigh 8.1
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_function() function in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2025WP Import – Ultimate CSV XML Importer for: Remote Code ExecutionCVE-2025-10057 · affects up to 7.28 · reported by WordfenceHigh 8.8
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the write_to_customfile() function writing unfiltered PHP code to a file. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject the customFunction.php file with PHP code that can be accessed to trigger remote code execution.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2025WP Import – Ultimate CSV XML Importer for: Unauthorized access of dataCVE-2025-10040 · affects up to 7.27 · reported by WordfenceHigh 7.7
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a configured set of SFTP/FTP credentials.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 1, 2025Import Export Suite for CSV and XML Datafeed: Arbitrary file uploadsCVE-2025-2008 · affects up to 7.19 · reported by WordfenceHigh 8.8
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 1, 2025Import Export Suite for CSV and XML Datafeed: Arbitrary file deletionCVE-2025-2007 · affects up to 7.19 · reported by WordfenceHigh 8.1
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 3, 2023WP Ultimate CSV Importer: Remote Code ExecutionCVE-2023-4142 · affects up to 7.9.8 · reported by WordfenceHigh 8
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means remote code execution is still possible for site administrators, use the plugin with caution.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 3, 2023WP Ultimate CSV Importer: Remote Code ExecutionCVE-2023-4141 · affects up to 7.9.8 · reported by WordfenceHigh 8
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file creation is still allowed for site administrators, use the plugin with caution.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 3, 2023WP Ultimate CSV Importer: Privilege escalationCVE-2023-4140 · affects up to 7.9.8 · reported by WordfenceMedium 6.6
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions such as an author, if the administrator previously grants access in the plugin settings, to modify their user role by supplying the 'wp_capabilities->cus1' parameter.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 3, 2023WP Ultimate CSV Importer: Sensitive Information ExposureCVE-2023-4139 · affects up to 7.9.8 · reported by WordfenceHigh 7.5
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and view exported files.
Aug 14, 2019The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.CVE-2018-20967 · fixed in 5.6.1 · reported by MITREHigh 8.8
The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
Aug 12, 2019The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.CVE-2015-9306 · fixed in 3.8.1 · reported by MITREMedium 6.1
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.