Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

477new WordPress flaws this week

390,525entries in the database

444 results · page 4 of 9

Sep 10, 2025Import any XML, CSV or Excel File to: Arbitrary file uploadsCVE-2025-10001 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload unsafe files like .phar files on the affected site's server which may make remote code execution possible.
Product
Import any XML, CSV or Excel File to
Affected
up to 3.9.3
What to do
Affects up to 3.9.3. Update Import any XML, CSV or Excel File to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 29, 2025Ultimate Tag Warrior Importer: Cross-Site Request ForgeryCVE-2025-9374 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Tag Warrior Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to import tags granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Ultimate Tag Warrior Importer
Affected
up to 0.2
What to do
Affects up to 0.2. Update Ultimate Tag Warrior Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 28, 2025WooCommerce csv import export: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-54029 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in extendons WooCommerce csv import export extendons-eo-wooimport-export allows Path Traversal.This issue affects WooCommerce csv import export: from n/a through <= 2.0.6.
Product
WooCommerce csv import export
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update WooCommerce csv import export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 5, 2025WP Import Export Lite: Arbitrary file uploadsCVE-2025-6207 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WP Import Export Lite
Affected
up to 3.9.28
What to do
Affects up to 3.9.28. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025WP Import Export Lite: Arbitrary file uploadsCVE-2025-5061 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 3.9.29.
Product
WP Import Export Lite
Affected
up to 3.9.29
What to do
Affects up to 3.9.29. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2025The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site ImportsCVE-2025-4684 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image Slider widgets in all versions up to, and including, 3.2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.2.13.1
What to do
Affects up to 3.2.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 16, 2025Import CDN-Remote Images: Cross-Site Request Forgery (CSRF)CVE-2025-48153 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au Import CDN-Remote Images import-cdn-remote-images allows Stored XSS.This issue affects Import CDN-Remote Images: from n/a through <= 2.1.2.
Product
Import CDN-Remote Images
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Import CDN-Remote Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 12, 2025AIT CSV import/export: Arbitrary file uploadsCVE-2020-36849 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it possible for unauthorized attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
AIT CSV import/export
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update AIT CSV import/export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com raw.githubusercontent.com
Jun 27, 2025Import external attachments: Cross-Site Request Forgery (CSRF)CVE-2025-53268 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Cross Site Request Forgery.This issue affects Import external attachments: from n/a through <= 1.5.12.
Product
Import external attachments
Affected
up to 1.5.12
What to do
Affects up to 1.5.12. Update Import external attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Import YouTube videos as WP Posts: Missing AuthorizationCVE-2025-52802 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in enguerranws Import YouTube videos as WP Posts import-youtube-videos-as-wp-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import YouTube videos as WP Posts: from n/a through <= 2.1.
Product
Import YouTube videos as WP Posts
Affected
up to 2.1
What to do
Affects up to 2.1. Update Import YouTube videos as WP Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025CSV Importer Improved: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50013 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Judge CSV Importer Improved csv-importer-improved allows Stored XSS.This issue affects CSV Importer Improved: from n/a through <= 0.6.1.
Product
CSV Importer Improved
Affected
up to 0.6.1
What to do
Affects up to 0.6.1. Update CSV Importer Improved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 12, 2025REST API | Custom API Generator For Cross Platform And Import Export In WP: Privilege EscalationCVE-2025-5288 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.
Product
REST API | Custom API Generator For Cross Platform And Import Export In WP
Affected
1.0.0 to 2.0.3
What to do
Affects 1.0.0 to 2.0.3. Update REST API | Custom API Generator For Cross Platform And Import Export In WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 10, 2025Axle Demo Importer: Does not validate files to be uploadedCVE-2025-4954 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server
Product
Axle Demo Importer
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Axle Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 2, 2025WordPress Comments Import & Export: Unauthorized modification of dataCVE-2025-3919 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page. The vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4
Product
WordPress Comments Import & Export
Affected
up to 2.4.3
Fixed in
2.4.3
What to do
Update WordPress Comments Import & Export to 2.4.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 23, 2025WP Smart Import: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47453 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes WP Smart Import wp-smart-import allows PHP Local File Inclusion.This issue affects WP Smart Import: from n/a through <= 1.1.3.
Product
WP Smart Import
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update WP Smart Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WordPress Video Robot - The Ultimate Video Importer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39409 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Importer.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0.
Product
WordPress Video Robot - The Ultimate Video Importer
Affected
up to 1.20.0
What to do
Affects up to 1.20.0. Update WordPress Video Robot - The Ultimate Video Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Import Social Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48256 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes Import Social Events import-facebook-events allows Stored XSS.This issue affects Import Social Events: from n/a through <= 1.8.5.
Product
Import Social Events
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Import Social Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 17, 2025CSV Mass Importer: Does not properly validate uploaded filesCVE-2025-4190 · WordPress plugins & themes · reported by WPScanHigh 7.2
The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Product
CSV Mass Importer
Affected
up to 1.2
What to do
Affects up to 1.2. Update CSV Mass Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2025Import Export For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48144 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.
Product
Import Export For WooCommerce
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Import Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025AffiliateImporterEb: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12733 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
AffiliateImporterEb
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update AffiliateImporterEb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025AffiliateImporterEb: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12732 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
AffiliateImporterEb
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update AffiliateImporterEb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2025Flickr Shortcode Importer: Deserialization of Untrusted DataCVE-2025-46481 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode Importer: from n/a through <= 2.2.3.
Product
Flickr Shortcode Importer
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Flickr Shortcode Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 22, 2025WP Import Export Lite: Stored Cross-Site ScriptingCVE-2025-2839 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Import Export Lite
Affected
up to 3.9.27
What to do
Affects up to 3.9.27. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2025Product Excel Import Export & Bulk Edit for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32674 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Excel Import Export & Bulk Edit for WooCommerce webd-woocommerce-product-excel-importer-bulk-edit allows Reflected XSS.This issue affects Product Excel Import Export & Bulk Edit for WooCommerce: from n/a through <= 4.7.
Product
Product Excel Import Export & Bulk Edit for WooCommerce
Affected
up to 4.7
What to do
Affects up to 4.7. Update Product Excel Import Export & Bulk Edit for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Ultra Demo Importer: Cross-Site Request Forgery (CSRF)CVE-2025-32496 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Uncodethemes Ultra Demo Importer ut-demo-importer allows Upload a Web Shell to a Web Server.This issue affects Ultra Demo Importer: from n/a through <= 1.0.5.
Product
Ultra Demo Importer
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Ultra Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Import Export Suite for CSV and XML Datafeed: Arbitrary file uploadsCVE-2025-2008 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
Product
Import Export Suite for CSV and XML Datafeed
Affected
up to 7.19
What to do
Affects up to 7.19. Update Import Export Suite for CSV and XML Datafeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2025Import Export Suite for CSV and XML Datafeed: Arbitrary file deletionCVE-2025-2007 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
Product
Import Export Suite for CSV and XML Datafeed
Affected
up to 7.19
What to do
Affects up to 7.19. Update Import Export Suite for CSV and XML Datafeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: PHP Object InjectionCVE-2025-1913 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input from the 'form_data' parameter This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Server-Side Request ForgeryCVE-2025-1912 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Arbitrary file deletionCVE-2025-1911 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Directory TraversalCVE-2025-1769 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.0 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025WordPress Importer: PHP Object InjectionCVE-2024-13889 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.8.3 via deserialization of untrusted input in the 'maybe_unserialize' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
WordPress Importer
Affected
up to 0.8.3
What to do
Affects up to 0.8.3. Update WordPress Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Export and Import Users and Customers: Path TraversalCVE-2025-1973 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
Product
Export and Import Users and Customers
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Export and Import Users and Customers: Arbitrary file deletionCVE-2025-1972 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Product
Export and Import Users and Customers
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Export and Import Users and Customers: PHP Object InjectionCVE-2025-1971 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Export and Import Users and Customers
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Export and Import Users and Customers: Server-Side Request ForgeryCVE-2025-1970 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Export and Import Users and Customers
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Order Export & Order Import for WooCommerce: Server-Side Request ForgeryCVE-2024-13923 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.0 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Order Export & Order Import for WooCommerce: Arbitrary file deletionCVE-2024-13922 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Order Export & Order Import for WooCommerce: PHP Object InjectionCVE-2024-13921 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.0 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Order Export & Order Import for WooCommerce: Directory TraversalCVE-2024-13920 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.0 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2025The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalatioCVE-2024-13232 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalation due to a missing capability check on the renderImport() function in all versions up to, and including, 4.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary SQL statements that can leveraged to create a new administrative user account.
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 3, 2025DB Tables Import/Export: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27271 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberto Cocchiara DB Tables Import/Export db-tables-importexport allows Reflected XSS.This issue affects DB Tables Import/Export: from n/a through <= 1.0.1.
Product
DB Tables Import/Export
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update DB Tables Import/Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025DsgnWrks Twitter Importer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23762 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Sternberg DsgnWrks Twitter Importer dsgnwrks-twitter-importer allows Reflected XSS.This issue affects DsgnWrks Twitter Importer: from n/a through <= 1.1.4.
Product
DsgnWrks Twitter Importer
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update DsgnWrks Twitter Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 21, 2025Mambo Importer: PHP Object InjectionCVE-2024-13899 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted input via the $data parameter in the fImportMenu function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Mambo Importer
Affected
up to 1.0
What to do
Affects up to 1.0. Update Mambo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Easy MLS Listings Import: Stored Cross-Site ScriptingCVE-2024-12525 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy MLS Listings Import
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Easy MLS Listings Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2025WP All Import Pro: PHP Object InjectionCVE-2024-9664 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted input from an import file. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
WP All Import Pro
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Feb 7, 2025WP All Import Pro: Cross-Site Request ForgeryCVE-2024-9661 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported content (posts, comments, users, etc.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP All Import Pro
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Feb 3, 2025Import Excel to Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24629 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpgear Import Excel to Gravity Forms gf-excel-import allows Reflected XSS.This issue affects Import Excel to Gravity Forms: from n/a through <= 1.18.
Product
Import Excel to Gravity Forms
Affected
up to 1.18
What to do
Affects up to 1.18. Update Import Excel to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Catalog Importer, Scraper & Crawler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22775 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in idiatech Catalog Importer, Scraper & Crawler intelligent-importer allows Reflected XSS.This issue affects Catalog Importer, Scraper & Crawler: from n/a through <= 5.1.3.
Product
Catalog Importer, Scraper & Crawler
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update Catalog Importer, Scraper & Crawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 27, 2025Import and export users and customers: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-24689 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Retrieve Embedded Sensitive Data.This issue affects Import and export users and customers: from n/a through <= 1.27.12.
Product
Import and export users and customers
Affected
up to 1.27.12
What to do
Affects up to 1.27.12. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.