What’s Vulnerable › Products

wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets version is affected

Latest wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets vulnerabilities

• CVE-2026-2830 — WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath' (CVSS 6.1)
• CVE-2025-12733 — Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic (CVSS 8.8)
• CVE-2025-10001 — Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload (CVSS 7.2)
• CVE-2024-32431 — WordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection (CVSS 7.2)
• CVE-2022-1565 — Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload (CVSS 7.2)