WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export

Уязвимости

• CVE-2018-20967без авторизации · нужен клик

  The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.

  Высокий 8.8

• CVE-2026-13353подписчик+≤ 8.0.1

  WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter

  Высокий 8.8

• CVE-2025-10057подписчик+≤ 7.28

  WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection

  Высокий 8.8

• CVE-2025-2008подписчик+≤ 7.19

  Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload

  Высокий 8.8

• CVE-2023-4142автор+≤ 7.9.8

  WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution

  Высокий 8.8

• CVE-2023-4141автор+≤ 7.9.8

  WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution

  Высокий 8.8

• CVE-2023-4140автор+≤ 7.9.8

  WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation

  Высокий 8.8

• CVE-2025-10058подписчик+≤ 7.27

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion

  Высокий 8.1

• CVE-2025-2007подписчик+≤ 7.19

  Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion

  Высокий 8.1

• CVE-2025-10040подписчик+≤ 7.27

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure

  Высокий 7.7

• CVE-2023-4139без авторизации≤ 7.9.8

  WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing

  Высокий 7.5

• CVE-2025-13145админ≤ 7.33.1

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import

  Высокий 7.2

• CVE-2026-1317подписчик+≤ 7.37

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name

  Средний 6.5

• CVE-2025-14627участник+≤ 7.35

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass

  Средний 6.4

• CVE-2015-9306без авторизации · нужен клик

  The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.

  Средний 6.1

• CVE-2026-103336без авторизации≤ 9.1

  WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability

  Средний 5.3

• CVE-2025-12732автор+≤ 7.33

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure

  Средний 4.3