WordPress security by component
Product Import Export for WooCommerce
Plugin description
Product Import Export for WooCommerce is a WordPress component with 7 published CVE records in this archive. The latest tracked vulnerability was published May 27, 2026; the highest CVE/CNA score is 9.1.
Plugin slug:
product-import-export-for-wooLatest vulnerability
CVE-2026-48971: Product Import Export for WooCommerce: A security weakness
Product Import Export for WooCommerce is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.5.6.
| Safe version |
|
||
|---|---|---|---|
| May 27, 2026 |
CVE-2026-48971
Product Import Export for WooCommerce: A security weakness
Product Import Export for WooCommerce is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.5.6.
|
2.5.7 |
CVE4.3
NVDPending
|
| Mar 26, 2025 |
CVE-2025-1913
Product Import Export for WooCommerce – Import Export Product CSV Suite: Code execution
Product Import Export for WooCommerce – Import Export Product CSV Suite is affected by code execution. Exploitation requires at least administrator-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Mar 26, 2025 |
CVE-2025-1912
Product Import Export for WooCommerce – Import Export Product CSV Suite: Server-side request forgery
Product Import Export for WooCommerce – Import Export Product CSV Suite is affected by server-side request forgery. Exploitation requires at least administrator-level access. The vulnerable server can be induced to make attacker-selected network requests.
|
See mitigation notes |
CVE7.6
NVDPending
|
| Mar 26, 2025 |
CVE-2025-1911
Product Import Export for WooCommerce – Import Export Product CSV Suite: Arbitrary file deletion
Product Import Export for WooCommerce – Import Export Product CSV Suite is affected by arbitrary file deletion. Exploitation requires at least administrator-level access. A successful request can remove files outside the intended scope and may make the site unavailable.
|
See mitigation notes |
CVE2.7
NVD6.5
|
| Mar 26, 2025 |
CVE-2025-1769
Product Import Export for WooCommerce – Import Export Product CSV Suite: Filesystem traversal
Product Import Export for WooCommerce – Import Export Product CSV Suite is affected by filesystem traversal. Exploitation requires at least administrator-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE4.9
NVDPending
|
| Mar 26, 2024 |
CVE-2024-30231
Product Import Export for WooCommerce: Dangerous file upload
Product Import Export for WooCommerce is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE9.1
NVD7.2
|
| Jan 24, 2024 |
CVE-2024-22152
Product Import Export for WooCommerce: Dangerous file upload
Product Import Export for WooCommerce is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE8.0
NVD7.2
|