WordPress security by component

Import and export users and customers

Plugin description

Import and export users and customers imports WordPress users and customer records from CSV files, including supported custom metadata fields.

Import and export users and customers (import-users-from-csv-with-meta) is a WordPress plugin with 21 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 8.8.

Plugin slug: import-users-from-csv-with-meta

Latest vulnerability

CVE-2026-54862: Import and export users and customers: Stored cross-site scripting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 2.5.9.

PublishedOct 29, 2026

Known safe version2.5.10

Published vulnerabilities for import-users-from-csv-with-meta
		Safe version
Oct 29, 2026	CVE-2026-54862 Import and export users and customers: Stored cross-site scripting Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 2.5.9.	2.5.10	CVE6.5
Oct 06, 2026	CVE-2026-104757 Import and export users and customers: Privilege escalation The export requires the Editor role or higher. An attacker can cross a permission boundary and gain privileges beyond those intended for the caller. The role-changing operation, target privilege and endpoint are undisclosed. The supplied vector reports high confidentiality impact, high integrity impact, high availability impact. The vector requires no victim interaction. Affected versions: <= 2.5.5. The authoritative export identifies 2.5.7 as fixed for this CVE.	2.5.7	CVE7.2
Sep 30, 2026	CVE-2026-94178 Import and export users and customers: Privilege escalation or authentication bypass Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions. The reported impact is gaining permissions beyond the stated starting role. The target role and privilege-changing operation are unspecified. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 2.5.4.	2.5.4	CVE7.5
Sep 23, 2026	CVE-2026-86583 User CSV export and re-import can promote a Subscriber to Administrator A Subscriber or higher can save crafted display_name and nickname profile fields that straddle the exported role column. The exporter uses a NUL escape character in fputcsv(), but SplFileObject::fgetcsv() imports with the default backslash escape, shifting cell boundaries so import_user() applies an Administrator role via add_role(). Exploitation requires an administrator to export and re-import the file with both Update existing users and Update roles for existing users enabled; merely editing a profile does not grant privileges. Affected versions: <= 2.4.17. Confirmed fixed release: 2.4.18.	2.4.18	CVE8.8
Jul 10, 2026	CVE-2026-15026 Import and export users and customers: Sensitive information exposure Import and export users and customers is affected by sensitive information exposure. Exploitation requires an authenticated subscriber account. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 2.4.0.	2.4.1	CVE4.3
May 02, 2026	CVE-2026-7641 Import and export users and customers: Privilege escalation or authentication bypass Import and export users and customers is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 2.0.8.	See mitigation notes	CVE8.8
Mar 21, 2026	CVE-2026-3629 Import and export users and customers: Privilege escalation or authentication bypass Import and export users and customers is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE8.1
Jan 27, 2025	CVE-2025-24689 Import and export users and customers: A security weakness Import and export users and customers is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.9
Oct 29, 2024	CVE-2024-50413 Import and export users and customers: Cross-site scripting Import and export users and customers is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Aug 13, 2024	CVE-2024-38787 Import and export users and customers: A security weakness Import and export users and customers is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5
Jun 11, 2024	CVE-2024-34815 Import and export users and customers: A security weakness Import and export users and customers is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.4
Jun 08, 2024	CVE-2024-22151 Import and export users and customers: A security weakness Import and export users and customers is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
May 04, 2024	CVE-2024-1050 Import and export users and customers: A security weakness Import and export users and customers is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Apr 24, 2024	CVE-2024-32817 Import and export users and customers: Code execution Import and export users and customers is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE4.4
Nov 04, 2020	CVE-2020-22277 Import Users From Csv With Meta: A security weakness Import Users From Csv With Meta is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVEPending
Aug 22, 2019	CVE-2019-15329 Import Users From Csv With Meta: Cross-site request forgery Import Users From Csv With Meta is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVEPending
Aug 22, 2019	CVE-2019-15328 Import Users From Csv With Meta: Cross-site scripting Import Users From Csv With Meta is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending
Aug 22, 2019	CVE-2019-15327 Import Users From Csv With Meta: Cross-site scripting Import Users From Csv With Meta is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending
Aug 22, 2019	CVE-2019-15326 Import Users From Csv With Meta: Filesystem traversal Import Users From Csv With Meta is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVEPending
Aug 08, 2019	CVE-2019-14683 Import Users From Csv With Meta: Cross-site request forgery Import Users From Csv With Meta is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVEPending
Dec 12, 2018	CVE-2018-20101 Import Users From Csv With Meta: Cross-site scripting Import Users From Csv With Meta is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers