WordPress plugin
Import and export users and customers security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 35 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High13
- Medium22
- Low0
All Import and export users and customers vulnerabilities
- High8.8Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
≤2.5.11Update to 2.5.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.5.9Update to 2.5.10
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
≤2.4.5Update to 2.4.6
- Medium4.7Authenticated (Editor+) Privilege Escalation
≤2.5.5Update to 2.5.7
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
≤2.5.2Update to 2.5.4
- High8.8Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
≤2.4.17Update to 2.4.18
- High7.2Authenticated (Admin+) Privilege Escalation
≤2.5.1Update to 2.5.2
- High7.2Authenticated (Admin+) Privilege Escalation
≤2.5.1Update to 2.5.2
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery
≤2.4.4Update to 2.4.5
- Medium4.9Authenticated (Admin+) Arbitrary File Read
<2.4.3Update to 2.4.3
- High7.2Authenticated (Admin+) Privilege Escalation
≤2.4.1Update to 2.4.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action
≤2.4.0Update to 2.4.1
- High8.8Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields
≤2.0.8Update to 2.0.9
- High8.1Privilege Escalation to Administrator via save_extra_user_profile_fields
≤1.29.7Update to 2.0
- Medium5.3Unauthenticated Sensitive Information Disclosure
≤1.27.12Update to 1.27.13
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.27.5Update to 1.27.6
- Medium5.3Unauthenticated Information Exposure
≤1.26.8Update to 1.26.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.26.6.1Update to 1.26.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.26.6.1Update to 1.26.7
- Medium4.3Missing Authorization
≤1.26.5Update to 1.26.6
- Medium4.3Missing Authorization
≤1.26.5Update to 1.26.6
- High7.2Authenticated (Admin+) PHP Object Injection
≤1.26.2Update to 1.26.3
- Medium5.3Missing Authorization via fire_cron REST endpoint
≤1.24.6Update to 1.24.7
- Medium4.9Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
≤1.24.3Update to 1.24.4
- Medium6.6Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality
≤1.24.2Update to 1.24.3
- High8.0Authenticated (Subscriber+) CSV Injection
≤1.20.4Update to 1.20.5
- Medium5.5Stored Cross-Site Scripting
<1.19.2.1Update to 1.19.2.1
- High7.3CSV injection via a customer's profile
≤1.16.3.5Update to 1.16.3.6
- High7.7Sensitive Data Exposure
1.15 – 1.15Update to 1.15.0.1
- Medium6.3Cross-Site Request Forgery leading to attachment deletion & Path Traversal
≤1.14.1.3Update to 1.14.2.2
- Medium6.1Cross-Site Scripting
≤1.14.1.2Update to 1.14.1.3
- High7.5Directory Traversal
≤1.14.2.1Update to 1.14.2.2
- High8.8Cross-Site Request Forgery
<1.14.0.3Update to 1.14.0.3
- Medium6.1Cross-Site Scripting
<1.14.0.3Update to 1.14.0.3
- Medium6.1Import Cross-Site Scripting
<1.12.1Update to 1.12.1
Import and export users and customers: common questions
Does Import and export users and customers have known vulnerabilities?
Yes. VulnCrest Radar lists 35 known vulnerabilities in Import and export users and customers: 13 high, 22 medium. None are known to affect version null.
How do I check which version of Import and export users and customers I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Import and export users and customers vulnerability?
CVE-2026-120554, published Nov 3, 2026: Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save. Severity: High (CVSS 8.8).
Is any Import and export users and customers vulnerability listed in CISA KEV?
No. None of the known Import and export users and customers vulnerabilities is currently listed in the CISA KEV catalog.