WordPress security by component
Import and export users and customers
Plugin description
Import and export users and customers is a WordPress component with 17 published CVE records in this archive. The latest tracked vulnerability was published Jul 10, 2026; the highest CVE/CNA score is 8.8.
Plugin slug:
import-users-from-csv-with-metaLatest vulnerability
CVE-2026-15026: Import and export users and customers: Sensitive information exposure
Import and export users and customers is affected by sensitive information exposure. Exploitation requires at least subscriber-level access. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 2.4.0.
| Safe version |
|
||
|---|---|---|---|
| Jul 10, 2026 |
CVE-2026-15026
Import and export users and customers: Sensitive information exposure
Import and export users and customers is affected by sensitive information exposure. Exploitation requires at least subscriber-level access. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 2.4.0.
|
> 2.4.0 |
CVE4.3
NVDPending
|
| May 02, 2026 |
CVE-2026-7641
Import and export users and customers: Privilege escalation or authentication bypass
Import and export users and customers is affected by privilege escalation or authentication bypass. Exploitation requires at least subscriber-level access. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 2.0.8.
|
> 2.0.8 |
CVE8.8
NVDPending
|
| Mar 21, 2026 |
CVE-2026-3629
Import and export users and customers: Privilege escalation or authentication bypass
Import and export users and customers is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.1
NVDPending
|
| Jan 27, 2025 |
CVE-2025-24689
Import and export users and customers: A security weakness
Import and export users and customers is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.9
NVDPending
|
| Oct 29, 2024 |
CVE-2024-50413
Import and export users and customers: Cross-site scripting
Import and export users and customers is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVDPending
|
| Aug 13, 2024 |
CVE-2024-38787
Import and export users and customers: A security weakness
Import and export users and customers is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Jun 11, 2024 |
CVE-2024-34815
Import and export users and customers: A security weakness
Import and export users and customers is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.4
NVDPending
|
| Jun 08, 2024 |
CVE-2024-22151
Import and export users and customers: A security weakness
Import and export users and customers is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| May 04, 2024 |
CVE-2024-1050
Import and export users and customers: A security weakness
Import and export users and customers is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Apr 24, 2024 |
CVE-2024-32817
Import and export users and customers: Code execution
Import and export users and customers is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE4.4
NVDPending
|
| Nov 04, 2020 |
CVE-2020-22277
Import Users From Csv With Meta: A security weakness
Import Users From Csv With Meta is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE8.0
NVD8.0
|
| Aug 22, 2019 |
CVE-2019-15329
Import Users From Csv With Meta: Cross-site request forgery
Import Users From Csv With Meta is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Aug 22, 2019 |
CVE-2019-15328
Import Users From Csv With Meta: Cross-site scripting
Import Users From Csv With Meta is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Aug 22, 2019 |
CVE-2019-15327
Import Users From Csv With Meta: Cross-site scripting
Import Users From Csv With Meta is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Aug 22, 2019 |
CVE-2019-15326
Import Users From Csv With Meta: Filesystem traversal
Import Users From Csv With Meta is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVD7.5
|
| Aug 08, 2019 |
CVE-2019-14683
Import Users From Csv With Meta: Cross-site request forgery
Import Users From Csv With Meta is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.7
NVD5.7
|
| Dec 12, 2018 |
CVE-2018-20101
Import Users From Csv With Meta: Cross-site scripting
Import Users From Csv With Meta is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|