WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

Vulnerabilities

• CVE-2015-9330

  The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.

  Critical 9.8

• CVE-2025-12733

  Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic

  High 8.8

• CVE-2026-57628

  WordPress WP All Import plugin <= 4.0.1 - SQL Injection vulnerability

  High 7.6

• CVE-2015-9331

  The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.

  High 7.5

• CVE-2025-10001

  Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload

  High 7.2

• CVE-2022-36386

  WordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerability

  High 7.2

• CVE-2022-1565

  Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload

  High 7.2

• CVE-2026-2830

  WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'

  Medium 6.1

• CVE-2018-20978

  The wp-all-import plugin before 3.4.7 for WordPress has XSS.

  Medium 6.1

• CVE-2017-18567

  The wp-all-import plugin before 3.4.6 for WordPress has XSS.

  Medium 6.1

• CVE-2015-9329

  The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.

  Medium 6.1

• CVE-2018-0547

  Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web s

  Medium 6.1

• CVE-2018-0546

  Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web s

  Medium 6.1

• CVE-2024-31939

  WordPress Import any XML or CSV File to WordPress plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) vulnerability

  Medium 4.3