Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-21
WP Import Export Lite - Security Vulnerability (CVE-2026-76554)
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.
PLUGIN
WP Import Export Lite
CVE-2026-76554
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76552)
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.
PLUGIN
WP Import Export Lite
CVE-2026-76552
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76558)
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
PLUGIN
WP Import Export Lite
CVE-2026-76558
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76557)
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to perform SQL injection attacks.
PLUGIN
WP Import Export Lite
CVE-2026-76557
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76556)
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.
PLUGIN
WP Import Export Lite
CVE-2026-76556
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76555)
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to disclose sensitive files from the server, including files located outside the web root. The same code path also relaxes the file-system permissions of any path it is given, whether or not the copy succeeds.
PLUGIN
WP Import Export Lite
CVE-2026-76555
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76553)
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability to delete arbitrary directories, and every file within them, including outside the web root.
PLUGIN
WP Import Export Lite
CVE-2026-76553
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76559)
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.
PLUGIN
WP Import Export Lite
CVE-2026-76559
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76551)
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.
PLUGIN
WP Import Export Lite
CVE-2026-76551
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76550)
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.
PLUGIN
WP Import Export Lite
CVE-2026-76550
Risk Score
Threat Entry
Updated 2026-07-06
Wp Import Export Lite - Server-Side Request Forgery (SSRF) (CVE-2026-11397)
The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpie_import_upload_file_from_url AJAX action. The plugin's URL downloader first calls wp_safe_remote_get() (which correctly blocks private/reserved IP ranges), but when that call returns a WP_Error — the exact outcome for any blocked internal host — the Download::download_file() method falls back to GuzzleHttp\Client::request() with the original attacker-supplied URL and no SSRF protection (and with TLS verification disabled). This makes it possible for authenticated attackers, with administrator-level access and above,…
PLUGIN
Wp Import Export Lite
CVE-2026-11397
Risk Score
Threat Entry
Updated 2026-06-17
Wp Import Export Lite - Remote Code Execution (CVE-2025-6207)
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Wp Import Export Lite
CVE-2025-6207
Risk Score
Threat Entry
Updated 2026-06-17
Wp Import Export Lite - Remote Code Execution (CVE-2025-5061)
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 3.9.29.
PLUGIN
Wp Import Export Lite
CVE-2025-5061
Risk Score
Threat Entry
Updated 2026-06-17
Wp Import Export Lite - Cross-Site Scripting (XSS) (CVE-2025-2839)
The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Import Export Lite
CVE-2025-2839
Risk Score
Threat Entry
Updated 2026-06-17
Wp Import Export Lite - PHP Object Injection (CVE-2024-31308)
Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.
PLUGIN
Wp Import Export Lite
CVE-2024-31308
Risk Score
Threat Entry
Updated 2026-06-17
Wp Import Export Lite - Information Disclosure (CVE-2022-0236)
The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.
PLUGIN
Wp Import Export Lite
CVE-2022-0236
Risk Score