WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress

Güvenlik açıkları

• CVE-2026-13353

  WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter

  Yüksek 8.8

• CVE-2025-10057

  WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection

  Yüksek 8.8

• CVE-2025-2008

  Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload

  Yüksek 8.8

• CVE-2023-4142

  WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution

  Yüksek 8.8

• CVE-2023-4141

  WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution

  Yüksek 8.8

• CVE-2023-4140

  WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation

  Yüksek 8.8

• CVE-2018-20967

  The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.

  Yüksek 8.8

• CVE-2025-10058

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion

  Yüksek 8.1

• CVE-2025-2007

  Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion

  Yüksek 8.1

• CVE-2025-10040

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure

  Yüksek 7.7

• CVE-2023-4139

  WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing

  Yüksek 7.5

• CVE-2025-13145

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import

  Yüksek 7.2

• CVE-2026-1317

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name

  Orta 6.5

• CVE-2025-14627

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass

  Orta 6.4

• CVE-2015-9306

  The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.

  Orta 6.1

• CVE-2026-103336

  WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability

  Orta 5.3

• CVE-2025-12732

  WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure

  Orta 4.3