WordPress plugin
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 32 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High16
- Medium16
- Low0
All WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export vulnerabilities
- Medium4.9Authenticated (Administrator+) SQL Injection
≤9.2Update to 9.3
- Medium5.3Unauthenticated Information Exposure
≤9.1Update to 9.2
- Medium4.49.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
7.17 – 9.1Update to 9.2
- Medium5.3Unauthenticated Information Exposure
≤9.1Update to 9.2
- Medium4.9Authenticated (Administrator+) SQL Injection
<9.0Update to 9.0
- High8.8Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter
≤8.0.1Update to 8.1
- Medium6.5Authenticated (Subscriber+) SQL Injection via File Name
≤7.37Update to 7.38
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass
≤7.35Update to 7.36
- High7.2Authenticated (Administrator+) PHP Object Injection via CSV Import
≤7.33.1Update to 7.34
- Medium4.3Missing Authorization to Authenticated (Author+) Sensitive Information Exposure
≤7.33Update to 7.33.1
- High8.87.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection
7.20 – 7.28Update to 7.29
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤7.27Update to 7.28
- High7.7Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure
≤7.27Update to 7.28
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤7.20Update to 7.19.1 or 7.20.1
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤7.20Update to 7.19.1 or 7.20.1
- High8.0Authenticated (Author+) Remote Code Execution
≤7.9.8Update to 7.9.9
- Medium6.6Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation
≤7.9.8Update to 7.9.9
- High7.5Sensitive Information Exposure via Directory Listing
≤7.9.8Update to 7.9.9
- High8.0Authenticated (Author+) PHP File Creation to Remote Code Execution
≤7.9.8Update to 7.9.9
- High7.2Authenticated (Administrator+) SQL Injection
≤6.5.7Update to 6.5.8
- Medium5.4Missing Authorization
≤6.5.7Update to 6.5.8
- Medium4.1Server-Side Request Forgery
≤6.5.2Update to 6.5.3
- Medium4.8Admin+ Stored Cross-Site Scripting
<6.4.3Update to 6.4.3
- High7.1Missing Authorization
≤6.4.1Update to 6.4.2
- Medium6.3Missing Authorization Checks
<6.4.1Update to 6.4.1
- High8.8Arbitrary File Upload
≤6.4.0Update to 6.4.1
- High8.8Cross-Site Request Forgery
≤5.6Update to 5.6.1
- Medium6.1Reflected Cross-Site Scripting
<3.8.8Update to 3.8.8
- Medium6.1Cross-Site Scripting
<3.8.1Update to 3.8.1
- Medium4.3Cross-Site Request Forgery
≤3.7.2Update to 3.7.3
- High7.5Arbitrary File Read
≤3.7Update to 3.7.1
- High7.5Information Disclosure
<3.6.75Update to 3.6.75
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export: common questions
Does WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export have known vulnerabilities?
Yes. VulnCrest Radar lists 32 known vulnerabilities in WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export: 16 high, 16 medium. None are known to affect version null.
How do I check which version of WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export vulnerability?
CVE-2026-45440, published Oct 7, 2026: WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.2 - Authenticated (Administrator+) SQL Injection. Severity: Medium (CVSS 4.9).
Is any WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export vulnerability listed in CISA KEV?
No. None of the known WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export vulnerabilities is currently listed in the CISA KEV catalog.