Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-04
Import and export users and customers - Security Vulnerability (CVE-2026-120554)
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and…
PLUGIN
Import and export users and customers
CVE-2026-120554
Risk Score
Threat Entry
Updated 2026-10-06
Import and export users and customers - Security Vulnerability (CVE-2026-104757)
Editor Privilege Escalation in Import and export users and customers
PLUGIN
Import and export users and customers
CVE-2026-104757
Risk Score
Threat Entry
Updated 2026-09-30
Import and export users and customers - Security Vulnerability (CVE-2026-94178)
Subscriber Privilege Escalation in Import and export users and customers
PLUGIN
Import and export users and customers
CVE-2026-94178
Risk Score
Threat Entry
Updated 2026-09-24
Import and export users and customers - Security Vulnerability (CVE-2026-86583)
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname…
PLUGIN
Import and export users and customers
CVE-2026-86583
Risk Score
Threat Entry
Updated 2026-09-21
Import and export users and customers - Security Vulnerability (CVE-2026-92541)
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
PLUGIN
Import and export users and customers
CVE-2026-92541
Risk Score
Threat Entry
Updated 2026-09-21
Import and export users and customers - Security Vulnerability (CVE-2026-92540)
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
PLUGIN
Import and export users and customers
CVE-2026-92540
Risk Score
Threat Entry
Updated 2026-09-21
Import and export users and customers - Security Vulnerability (CVE-2026-16542)
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
PLUGIN
Import and export users and customers
CVE-2026-16542
Risk Score
Threat Entry
Updated 2026-08-26
Import and export users and customers - Security Vulnerability (CVE-2026-16534)
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
PLUGIN
Import and export users and customers
CVE-2026-16534
Risk Score
Threat Entry
Updated 2026-08-26
Import and export users and customers - Security Vulnerability (CVE-2025-15673)
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
PLUGIN
Import and export users and customers
CVE-2025-15673
Risk Score
Threat Entry
Updated 2026-07-10
Import and export users and customers - Information Disclosure (CVE-2026-15026)
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template…
PLUGIN
Import and export users and customers
CVE-2026-15026
Risk Score
Threat Entry
Updated 2026-06-17
Import and export users and customers - Privilege Escalation (CVE-2026-7641)
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing these keys to pass the `in_array()` check and be written directly to user meta via `update_user_meta()`. This makes it possible for authenticated…
PLUGIN
Import and export users and customers
CVE-2026-7641
Risk Score
Threat Entry
Updated 2026-06-17
Import and export users and customers - Privilege Escalation (CVE-2026-3629)
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be updated via profile fields. The 'get_restricted_fields' method does not include sensitive meta keys such as 'wp_capabilities'. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator by submitting a crafted registration request that sets the 'wp_capabilities' meta key. The vulnerability can only be exploited if the "Show fields…
PLUGIN
Import and export users and customers
CVE-2026-3629
Risk Score
Threat Entry
Updated 2026-06-17
Import And Export Users And Customers - Broken Access Control (CVE-2024-22151)
Missing Authorization vulnerability in Codection Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.24.6.
PLUGIN
Import And Export Users And Customers
CVE-2024-22151
Risk Score
Threat Entry
Updated 2026-06-17
Import and export users and customers - Cross-Site Scripting (XSS) (CVE-2024-4734)
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Import and export users and customers
CVE-2024-4734
Risk Score
Threat Entry
Updated 2026-06-17
Import and export users and customers - Cross-Site Scripting (XSS) (CVE-2024-4656)
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Import and export users and customers
CVE-2024-4656
Risk Score
Threat Entry
Updated 2026-06-17
Import and export users and customers - Broken Access Control (CVE-2024-1050)
The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all forced password resets. CVE-2024-34815 is a duplicate of this issue.
PLUGIN
Import and export users and customers
CVE-2024-1050
Risk Score
Threat Entry
Updated 2026-06-17
Import And Export Users And Customers - Cross-Site Scripting (XSS) (CVE-2023-6624)
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.24.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Import And Export Users And Customers
CVE-2023-6624
Risk Score
Threat Entry
Updated 2026-06-17
Import And Export Users And Customers - Path Traversal (CVE-2023-6583)
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information.
PLUGIN
Import And Export Users And Customers
CVE-2023-6583
Risk Score
Threat Entry
Updated 2026-06-17
Import And Export Users And Customers - Security Vulnerability (CVE-2022-3558)
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
PLUGIN
Import And Export Users And Customers
CVE-2022-3558
Risk Score
Threat Entry
Updated 2026-06-17
Import And Export Users And Customers - Cross-Site Scripting (XSS) (CVE-2022-1255)
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
PLUGIN
Import And Export Users And Customers
CVE-2022-1255
Risk Score