What’s Vulnerable › Products
carazo Import and export users and customers vulnerabilities
20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.
Check whether your carazo Import and export users and customers version is affected
Latest carazo Import and export users and customers vulnerabilities
- CVE-2026-17001 — Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields (CVSS 6.4)
- CVE-2026-86583 — Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields (CVSS 8.8)
- CVE-2026-92541 — Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer (CVSS 7.2)
- CVE-2026-92540 — Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users (CVSS 7.2)
- CVE-2026-16542 — Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar (CVSS 4.1)
- CVE-2026-16534 — Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import (CVSS 9.1)
- CVE-2025-15673 — Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read (CVSS 4.9)
- CVE-2026-15026 — Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action (CVSS 4.3)
- CVE-2026-7641 — Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields (CVSS 8.8)
- CVE-2026-3629 — Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields (CVSS 8.1)
- CVE-2024-38787 — WordPress Import and export users and customers plugin <= 1.26.8 - Sensitive Information via Imported File vulnerability (CVSS 7.5)
- CVE-2024-22151 — WordPress Import and export users and customers plugin <= 1.24.6 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2024-4734 — Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
- CVE-2024-4656 — Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
- CVE-2024-1050 — Import and export users and customers <= 1.26.5 - Missing Authorization (CVSS 4.3)
- CVE-2023-6624 — Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 5.4)
- CVE-2023-6583 — Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality (CVSS 7.2)
- CVE-2022-3558 — Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection (CVSS 8.0)
- CVE-2022-1255 — Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site Scripting (CVSS 4.8)
- CVE-2020-22277 — (CVSS 8.0)