Is WP All Import safe?

Every recorded flaw

• Jun 26, 2026Administrator SQL Injection in WP All Import <= 4.0.1 versions.CVE-2026-57628 · affects up to 4.0.1 · reported by PatchstackHigh 7.6
• Mar 6, 2026WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets: Reflected Cross-Site ScriptingCVE-2026-2830 · affects up to 4.0.0 · reported by WordfenceMedium 6.1
• Nov 12, 2025Import any XML, CSV or Excel File to WordPress (WP All Import): Remote Code ExecutionCVE-2025-12733 · affects up to 3.9.6 · reported by WordfenceHigh 8.8
• Sep 10, 2025Import any XML, CSV or Excel File to: Arbitrary file uploadsCVE-2025-10001 · affects up to 3.9.3 · reported by WordfenceHigh 7.2
• Apr 10, 2024Import any XML or CSV File to: Cross-Site Request Forgery (CSRF)CVE-2024-31939 · affects up to 3.7.3 · reported by PatchstackMedium 4.3
• Jan 22, 2024Import any XML or CSV File to: Accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file typeCVE-2023-7082 · fixed in 3.7.3 · reported by WPScan1.2% oddsHigh 7.2
• Nov 7, 2022Import any XML or CSV File to: Is not properly filteringCVE-2022-3418 · fixed in 3.6.9 · reported by WPScan1.2% oddsHigh 7.2
• Nov 7, 2022Import any XML or CSV File to: Is not validating the paths of files contained in uploaded zip archivesCVE-2022-2711 · fixed in 3.6.9 · reported by WPScan3.6% oddsHigh 7.2
• Sep 21, 2022Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.CVE-2022-36386 · affects up to 3.6.7 · reported by Patchstack1.5% oddsCritical 9.1
• Jul 18, 2022The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, anCVE-2022-1565 · affects up to 3.6.7 · reported by Wordfence15% oddsHigh 7.2
• Jul 4, 2022Import any XML or CSV File to: Accepts all zip files and automatically extracts the zip file without validating the extracted file typeCVE-2022-2268 · fixed in 3.6.8 · reported by WPScan1.4% oddsHigh 7.2
• Dec 6, 2021Import any XML or CSV File to: Does not escape the Import's Title and Unique Identifier fields before outputting them in admin pagesCVE-2021-24714 · fixed in 3.6.3 · reported by WPScanMedium 4.8
• Aug 20, 2019The wp-all-import plugin before 3.4.7 for WordPress has XSS.CVE-2018-20978 · fixed in 3.4.7 · reported by MITREMedium 6.1
• Aug 20, 2019The wp-all-import plugin before 3.4.6 for WordPress has XSS.CVE-2017-18567 · fixed in 3.4.6 · reported by MITREMedium 6.1
• Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · fixed in 3.2.4 · reported by MITRE1.4% oddsHigh 7.5
• Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.CVE-2015-9330 · fixed in 3.2.5 · reported by MITRE1.8% oddsCritical 9.8
• Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.CVE-2015-9329 · fixed in 3.2.5 · reported by MITREMedium 6.1
• Mar 9, 2018WP All Import plugin prior to version 3.4.7 for: Cross-site scriptingCVE-2018-0547 · affects up to 3.4.6 · reported by vultures@jpcert.or.jp1.5% oddsMedium 6.1
• Mar 9, 2018WP All Import plugin prior to version 3.4.6 for: Cross-site scriptingCVE-2018-0546 · fixed in 3.4.6 · reported by vultures@jpcert.or.jp1.5% oddsMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.