Wp All Import Vulnerabilities

The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for auth...

CVSS:

4.9

Affected:

up to 4.0.1

Fixed in:

4.1.0

Disclosed:

Jun 26, 2026

CVE-2026-57628 on NVD →

Reflected Cross-Site Scripting via 'filepath' vulnerability

CVSS:

7.1

Affected:

up to 4.0.0

Fixed in:

4.0.1

Disclosed:

Mar 6, 2026

The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filepath’ parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVSS:

6.1

Affected:

up to 4.0.0

Fixed in:

4.0.1

Disclosed:

Mar 5, 2026

CVE-2026-2830 on NVD →

[en] The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possibl...

Affected:

up to 4.0.0

Fixed in:

4.0.0

Disclosed:

Nov 13, 2025

CVE-2025-12733 on NVD →

The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for...

CVSS:

8.8

Affected:

up to 3.9.6

Fixed in:

4.0.0

Disclosed:

Nov 12, 2025

CVE-2025-12733 on NVD →

[en] The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above,...

Affected:

up to 3.9.4

Fixed in:

3.9.4

Disclosed:

Sep 10, 2025

CVE-2025-10001 on NVD →

The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to u...

CVSS:

7.2

Affected:

up to 3.9.3

Fixed in:

3.9.4

Disclosed:

Sep 9, 2025

CVE-2025-10001 on NVD →

Multiple plugins for WordPress utilize a vulnerable dependency (PHPExcel) in various versions. No vulnerabilities have been confirmed exploitable in either plugin, however, an update is still recommended for both.

CVSS:

3.7

Affected:

up to 3.8.0

Fixed in:

3.9.0

Disclosed:

Apr 7, 2025

CVE-2014-2054 on NVD →

The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.7.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to dismiss notices via a forged reques...

CVSS:

4.3

Affected:

up to 3.7.3

Fixed in:

3.7.4

Disclosed:

Apr 10, 2024

CVE-2024-31939 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Import any XML or CSV File to WordPress.This issue affects Import any XML or CSV File to WordPress: from n/a through 3.7.3.

Affected:

up to 3.7.4

Fixed in:

3.7.4

Disclosed:

Apr 10, 2024

CVE-2024-31939 on NVD →

[en] The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type le...

Affected:

up to 3.7.3

Fixed in:

3.7.3

Disclosed:

Jan 22, 2024

CVE-2023-7082 on NVD →

The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload functionality in all versions up to, and including, 3.7.2 . This makes it possible for authenticated attackers with admin-level access and above, to upload arbitrary...

CVSS:

7.2

Affected:

up to 3.7.3

Fixed in:

3.7.3

Disclosed:

Dec 29, 2023

CVE-2023-7082 on NVD →

[en] The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files

Affected:

up to 3.6.9

Fixed in:

3.6.9

Disclosed:

Nov 7, 2022

CVE-2022-3418 on NVD →

[en] The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.

Affected:

up to 3.6.9

Fixed in:

3.6.9

Disclosed:

Nov 7, 2022

CVE-2022-2711 on NVD →

The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file path validation in uploaded zip archives in versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with administrator-level permissions and above, to upload arb...

CVSS:

6.5

Affected:

up to 3.6.8

Fixed in:

3.6.9

Disclosed:

Oct 17, 2022

CVE-2022-2711 on NVD →

The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to improper file extension validation when uploading files in versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with administrator-level permissions and above, to upload a...

CVSS:

6.5

Affected:

up to 3.6.8

Fixed in:

3.6.9

Disclosed:

Oct 17, 2022

CVE-2022-3418 on NVD →

[en] Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.

Affected:

up to 3.6.8

Fixed in:

3.6.8

Disclosed:

Sep 21, 2022

CVE-2022-36386 on NVD →

[en] The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the af...

Affected:

up to 3.6.8

Fixed in:

3.6.8

Disclosed:

Jul 18, 2022

CVE-2022-1565 on NVD →

[en] The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE

Affected:

up to 3.6.8

Fixed in:

3.6.8

Disclosed:

Jul 4, 2022

CVE-2022-2268 on NVD →

The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE

CVSS:

4.8

Affected:

up to 3.6.7

Fixed in:

3.6.8

Disclosed:

Jul 1, 2022

CVE-2022-2268 on NVD →

The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affecte...

CVSS:

7.2

Affected:

up to 3.6.7

Fixed in:

3.6.8

Disclosed:

Jun 30, 2022

CVE-2022-1565 on NVD →

The WP All Import plugin for WordPress is vulnerable to arbitrary code execution in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator-level permissions and above, to execute arbitrary code.

CVSS:

9.1

Affected:

up to 3.6.7

Fixed in:

3.6.8

Disclosed:

Jun 28, 2022

CVE-2022-36386 on NVD →

The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg| without appropriate escaping on the URL in versions up to, and including, 3.6.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

6.1

Affected:

up to 3.6.6

Fixed in:

3.6.7

Disclosed:

Jun 2, 2022

The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg| without appropriate escaping on the URL in versions up to, and including, 3.6.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

Affected:

up to 3.6.7

Fixed in:

3.6.7

Disclosed:

Jun 2, 2022

[en] The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.

Affected:

up to 3.6.3

Fixed in:

3.6.3

Disclosed:

Dec 6, 2021

CVE-2021-24714 on NVD →

The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.

CVSS:

4.8

Affected:

up to 3.6.3

Fixed in:

3.6.3

Disclosed:

Nov 2, 2021

CVE-2021-24714 on NVD →

The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 3.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authentic...

CVSS:

7.2

Affected:

up to 3.2.4

Fixed in:

3.2.5

Disclosed:

Feb 19, 2020

The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 3.2.4 due to missing capability and nonce checks on various functions.

CVSS:

6.3

Affected:

up to 3.2.4

Fixed in:

3.2.5

Disclosed:

Feb 19, 2020

The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 3.2.4 due to missing capability and nonce checks on various functions.

Affected:

up to 3.2.5

Fixed in:

3.2.5

Disclosed:

Feb 19, 2020

The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 3.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authentic...

Affected:

up to 3.2.5

Fixed in:

3.2.5

Disclosed:

Feb 19, 2020

The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.

CVSS:

7.5

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Aug 20, 2019

CVE-2015-9331 on NVD →

[en] The wp-all-import plugin before 3.4.7 for WordPress has XSS.

Affected:

up to 3.4.7

Fixed in:

3.4.7

Disclosed:

Aug 20, 2019

CVE-2018-20978 on NVD →

[en] The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Aug 20, 2019

CVE-2015-9331 on NVD →

[en] The wp-all-import plugin before 3.4.6 for WordPress has XSS.

Affected:

up to 3.4.6

Fixed in:

3.4.6

Disclosed:

Aug 20, 2019

CVE-2017-18567 on NVD →

[en] The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.

Affected:

up to 3.2.5

Fixed in:

3.2.5

Disclosed:

Aug 20, 2019

CVE-2015-9329 on NVD →

[en] The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.

Affected:

up to 3.2.5

Fixed in:

3.2.5

Disclosed:

Aug 20, 2019

CVE-2015-9330 on NVD →

[en] There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator

Affected:

up to 3.4.9

Fixed in:

3.4.9

Disclosed:

Apr 12, 2019

CVE-2018-16257 on NVD →

[en] There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in ad...

Affected:

up to 3.4.9

Fixed in:

3.4.9

Disclosed:

Apr 12, 2019

CVE-2018-16259 on NVD →

[en] There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administr...

Affected:

up to 3.4.9

Fixed in:

3.4.9

Disclosed:

Apr 12, 2019

CVE-2018-16258 on NVD →

[en] There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in adminis...

Affected:

up to 3.4.9

Fixed in:

3.4.9

Disclosed:

Apr 12, 2019

CVE-2018-16256 on NVD →

[en] There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator

Affected:

up to 3.4.9

Fixed in:

3.4.9

Disclosed:

Apr 12, 2019

CVE-2018-16254 on NVD →

[en] There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator

Affected:

up to 3.4.9

Fixed in:

3.4.9

Disclosed:

Apr 12, 2019

CVE-2018-16255 on NVD →

[en] Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

Affected:

up to 3.4.7

Fixed in:

3.4.7

Disclosed:

Mar 9, 2018

CVE-2018-0547 on NVD →

[en] Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

Affected:

up to 3.4.6

Fixed in:

3.4.6

Disclosed:

Mar 9, 2018

CVE-2018-0546 on NVD →

Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

CVSS:

6.1

Affected:

up to 3.4.6

Fixed in:

3.4.6

Disclosed:

Mar 8, 2018

CVE-2018-0546 on NVD →

Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

CVSS:

6.1

Affected:

up to 3.4.7

Fixed in:

3.4.7

Disclosed:

Mar 8, 2018

CVE-2018-0547 on NVD →

The wp-all-import plugin before 3.4.7 for WordPress has XSS.

CVSS:

6.1

Affected:

up to 3.4.7

Fixed in:

3.4.7

Disclosed:

Mar 7, 2018

CVE-2018-20978 on NVD →

Cross-Site Scripting (XSS) vulnerability found in WordPress Import any XML or CSV File to WordPress plugin (versions <=3.4.5).

Affected:

up to 3.4.6

Fixed in:

3.4.6

Disclosed:

Oct 17, 2017

The wp-all-import plugin before 3.4.6 for WordPress has XSS.

CVSS:

6.1

Affected:

up to 3.4.6

Fixed in:

3.4.6

Disclosed:

Oct 8, 2017

CVE-2017-18567 on NVD →

This plugin is prone to an SQL injection and cross site scripting vulnerabilities. Because of them, attackers can gain admin access to your website or trick you into visiting the malicious URL. Update the plugin.

Affected:

up to 3.2.5

Fixed in:

3.2.5

Disclosed:

Mar 17, 2015

The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.

CVSS:

9.8

Affected:

up to 3.2.5

Fixed in:

3.2.5

Disclosed:

Mar 12, 2015

CVE-2015-9330 on NVD →

The Import any XML or CSV File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

up to 3.2.4

Fixed in:

3.2.5

Disclosed:

Feb 26, 2015

CVE-2015-9329 on NVD →

Because of this vulnerability, remote attackers can upload arbitrary files to system or retrieve any files on the system that ends in .txt or .html. Update the plugin.

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Feb 26, 2015

[en] PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

Affected:

up to 3.9.0

Fixed in:

3.9.0

Disclosed:

Jun 4, 2014

CVE-2014-2054 on NVD →

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Affected:

up to 3.6.5

Fixed in:

3.6.5

Affected:

up to 3.8.0

Fixed in:

3.8.0

CVE-2024-9661 on NVD →