Extension WordPress
Vulnérabilités WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel
Cette page rassemble les failles publiées pour WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel
27 fiches
WP Ultimate CSV Importer <= 8.0.1 – Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter
The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is…
*-8.0.1
8.1
10/07/2026
WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 – Authenticated (Subscriber+) SQL Injection via File Name
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is due to insufficient escaping on the `file_name` parameter which is…
*-7.37
7.38
17/02/2026
WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 – Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.35. This is due to inadequate validation of the resolved URL after…
*-7.35
7.36
01/01/2026
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 – Authenticated (Administrator+) PHP Object Injection via CSV Import
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. This is due to deserialization of untrusted data supplied via CSV…
*-7.33.1
7.34
18/11/2025
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 – Missing Authorization to Authenticated (Author+) Sensitive Information Exposure
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting() function in all versions up to, and including,…
*-7.33
7.33.1
11/11/2025
WP Import – Ultimate CSV XML Importer for WordPress 7.20 – 7.28 – Authenticated (Subscriber+) Remote Code Execution via Code Injection
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the write_to_customfile() function writing unfiltered PHP code…
7.20-7.28
7.29
16/09/2025
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 – Authenticated (Subscriber+) Arbitrary File Deletion
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_function() function in all versions up to, and including, 7.27. This…
*-7.27
7.28
16/09/2025
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 – Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and including,…
*-7.27
7.28
09/09/2025
Import Export Suite for CSV and XML Datafeed <= 7.19 – Authenticated (Subscriber+) Arbitrary File Upload
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes…
*-7.19, 7.20
7.19.1, 7.20.1
31/03/2025
Import Export Suite for CSV and XML Datafeed <= 7.19 – Authenticated (Subscriber+) Arbitrary File Deletion
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes…
*-7.19, 7.20
7.19.1, 7.20.1
25/03/2025
WP Ultimate CSV Importer <= 7.9.8 – Authenticated (Author+) Remote Code Execution
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously…
*-7.9.8
7.9.9
03/08/2023
WP Ultimate CSV Importer <= 7.9.8 – Authenticated (Author+) PHP File Creation to Remote Code Execution
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously…
*-7.9.8
7.9.9
03/08/2023
WP Ultimate CSV Importer <= 7.9.8 – Sensitive Information Exposure via Directory Listing
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated…
*-7.9.8
7.9.9
03/08/2023
WP Ultimate CSV Importer <= 7.9.8 – Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions…
*-7.9.8
7.9.9
03/08/2023
WP Ultimate CSV Importer <= 6.5.7 – Missing Authorization
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on some of its functions in versions up to, and including, 6.5.7. This makes it possible for authenticated attackers,…
*-6.5.7
6.5.8
20/09/2022
WP Ultimate CSV Importer <= 6.5.7 – Authenticated (Administrator+) SQL Injection
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…
*-6.5.7
6.5.8
20/09/2022
WP Ultimate CSV Importer <= 6.5.2 – Server-Side Request Forgery
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege…
*-6.5.2
6.5.3
02/06/2022
WP Ultimate CSV Importer <= 6.4.2 – Admin+ Stored Cross-Site Scripting
The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and…
[*, 6.4.3)
6.4.3
26/01/2022
Import all XML, CSV & TXT into WordPress < 6.4.2 – Missing Authorization
The Import all XML, CSV & TXT into WordPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the disable_main_mode function in versions up to, and including, 6.4.1. This makes it possible…
*-6.4.1
6.4.2
17/01/2022
WP Ultimate CSV Importer <= 6.4.0 – Arbitrary File Upload
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip_upload AJAX call in versions up to, and including, 6.4.0. This makes it possible for subscriber-level…
*-6.4.0
6.4.1
12/01/2022
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.