Skip to content
Noroxi

WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress

wp-ultimate-csv-importer · plugin

Known security vulnerabilities for WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress. Find out in seconds which version runs on your site with WP Lens.

17 known vulnerabilities

latest Oct 1, 2026

Vulnerabilities

  • CVE-2026-13353

    WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter

    High 8.8

  • CVE-2025-10057

    WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection

    High 8.8

  • CVE-2025-2008

    Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload

    High 8.8

  • CVE-2023-4142

    WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution

    High 8.8

  • CVE-2023-4141

    WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution

    High 8.8

  • CVE-2023-4140

    WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation

    High 8.8

  • CVE-2018-20967

    The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.

    High 8.8

  • CVE-2025-10058

    WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion

    High 8.1

  • CVE-2025-2007

    Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion

    High 8.1

  • CVE-2025-10040

    WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure

    High 7.7

  • CVE-2023-4139

    WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing

    High 7.5

  • CVE-2025-13145

    WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import

    High 7.2

  • CVE-2026-1317

    WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name

    Medium 6.5

  • CVE-2025-14627

    WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass

    Medium 6.4

  • CVE-2015-9306

    The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.

    Medium 6.1

  • CVE-2026-103336

    WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability

    Medium 5.3

  • CVE-2025-12732

    WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure

    Medium 4.3

← Back to directory