Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-03-09
CVE-2026-2830 - Wp All Import Plugin
The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filepath’ parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Wp All Import
CVE-2026-2830
Risk Score
Threat Entry
Updated 2025-11-14
CVE-2025-12733 - Wp All Import Plugin
The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution.
PLUGIN
Wp All Import
CVE-2025-12733
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2024-9664 - Wp All Import Plugin
The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted input from an import file. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
Wp All Import
CVE-2024-9664
Risk Score
Threat Entry
Updated 2025-02-20
CVE-2022-36386 - Wp All Import Plugin
Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin
PLUGIN
Wp All Import
CVE-2022-36386
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-2268 - Wp All Import Plugin
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
PLUGIN
Wp All Import
CVE-2022-2268
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24714 - Wp All Import Plugin
The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Wp All Import
CVE-2021-24714
Risk Score