What’s Vulnerable › Products

Import any XML or CSV File to WordPress vulnerabilities

23 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your Import any XML or CSV File to WordPress version is affected

Latest Import any XML or CSV File to WordPress vulnerabilities

• CVE-2026-57628 — WordPress WP All Import plugin <= 4.0.1 - SQL Injection vulnerability (CVSS 7.6)
• CVE-2024-9664 — WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File (CVSS 7.2)
• CVE-2024-9661 — WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion (CVSS 4.3)
• CVE-2024-8722 — WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload (CVSS 5.5)
• CVE-2024-9624 — WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import (CVSS 7.6)
• CVE-2022-3418 — WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE (CVSS 7.2)
• CVE-2022-2711 — WP All Import < 3.6.9 - Admin+ Directory traversal via file upload (CVSS 7.2)
• CVE-2022-36386 — WordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerability (CVSS 7.2)
• CVE-2022-2268 — WP All Import < 3.6.8 - Admin+ Arbitrary File Upload (CVSS 7.2)
• CVE-2021-24714 — WP All Import < 3.6.3 - Admin+ Stored Cross-Site Scripting (CVSS 4.8)
• CVE-2018-20978 — (CVSS 6.1)
• CVE-2017-18567 — (CVSS 6.1)
• CVE-2015-9331 — (CVSS 7.5)
• CVE-2015-9330 — (CVSS 9.8)
• CVE-2015-9329 — (CVSS 6.1)
• CVE-2018-16259 — (CVSS 6.1)
• CVE-2018-16258 — (CVSS 6.1)
• CVE-2018-16257 — (CVSS 6.1)
• CVE-2018-16256 — (CVSS 6.1)
• CVE-2018-16255 — (CVSS 6.1)
• CVE-2018-16254 — (CVSS 6.1)
• CVE-2018-0547 — (CVSS 6.1)
• CVE-2018-0546 — (CVSS 6.1)