VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 26 known issues Latest disclosed Feb 17, 2026

WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress Vulnerabilities

Review known vulnerability records for the WordPress plugin WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress (`wp-ultimate-csv-importer`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-1317, CVE-2025-14627 and CVE-2025-13145, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
26
High or Critical
15
Patch Coverage
100%
Last Updated
Feb 18, 2026
Related Security Guides

Use these guides while reviewing WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
23
1. Match the Package
Confirm the installed WordPress plugin slug is wp-ultimate-csv-importer before acting on any CVE from this cluster.
2. Sort by Severity
Start with 15 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
26 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2025-10057 High
Remote Code Execution remediation for WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress

Affected range: 7.20 through 7.28. Fixed version: 7.29.

CVE-2025-2008 High
Remote Code Execution remediation for WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress

Affected range: Versions up to 7.19. Fixed version: 7.19.1.

CVE-2018-20967 High
Cross-Site Request Forgery remediation for WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress

Affected range: Versions up to 5.6. Fixed version: 5.6.1.

CVE-2025-10058 High
Remote Code Execution remediation for WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress

Affected range: Versions up to 7.27. Fixed version: 7.28.

Priority CVE Quick Links

Fast paths into WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
20
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2025-10057
WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Su...
 Remote Code Execution 7.20 through 7.28 7.29 CVSS 8.8
CVE-2025-2008
Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) A...
 Remote Code Execution Versions up to 7.19 7.19.1 CVSS 8.8
CVE-2018-20967
Easy Drag And drop All Import : WP Ultimate CSV Importer <= 5.6 - Cross-Site Request...
 Cross-Site Request Forgery Versions up to 5.6 5.6.1 CVSS 8.8
CVE-2025-10058
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscri...
 Remote Code Execution Versions up to 7.27 7.28 CVSS 8.1
CVE-2025-2007
Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) A...
 Remote Code Execution Versions up to 7.19 7.19.1 CVSS 8.1
CVE-2023-4141
WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Rem...
 Remote Code Execution Versions up to 7.9.8 7.9.9 CVSS 8.0
CVE-2023-4142
WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution
 Remote Code Execution Versions up to 7.9.8 7.9.9 CVSS 8.0
CVE-2025-10040
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization...
 Vulnerability Versions up to 7.27 7.28 CVSS 7.7
CVE-2025-10057 High 7.29
CVE-2025-10057 WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress Remote Code Execution

WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection

CVE-2025-2008 High 7.19.1
CVE-2025-2008 WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress Remote Code Execution

Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload

CVE-2018-20967 High 5.6.1
CVE-2018-20967 WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress Cross-Site Request Forgery

Easy Drag And drop All Import : WP Ultimate CSV Importer <= 5.6 - Cross-Site Request Forgery

CVE-2025-10058 High 7.28
CVE-2025-10058 WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress Remote Code Execution

WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion

CVE-2025-2007 High 7.19.1
CVE-2025-2007 WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress Remote Code Execution

Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion

CVE-2023-4141 High 7.9.9
CVE-2023-4141 WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress Remote Code Execution

WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution

CVE-2023-4142 High 7.9.9
CVE-2023-4142 WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress Remote Code Execution

WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution

CVE-2025-10040 High 7.28
CVE-2025-10040 WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress Vulnerability

WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
26 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 15 high severity findings.
Recent CVEs
CVE-2026-1317, CVE-2025-14627 and CVE-2025-13145
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-1317
CVE-2026-1317: WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is due to insufficient escaping on the `file_name` parameter which is stored in the database during file upload and later u...

Published
Feb 17, 2026
Patched Release
7.38
Affected Versions
Versions up to 7.37
Next Step
Update to 7.38 or newer if supported.
Review CVE-2026-1317 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-14627
CVE-2025-14627: WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.35. This is due to inadequate validation of the resolved URL after following Bitly shortlink redirects in the `upload_...

Published
Jan 01, 2026
Patched Release
7.36
Affected Versions
Versions up to 7.35
Next Step
Update to 7.36 or newer if supported.
Review CVE-2025-14627 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-13145
CVE-2025-13145: WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. This is due to deserialization of untrusted data supplied via CSV file imports in the import_single_post_as_csv functio...

Published
Nov 18, 2025
Patched Release
7.34
Affected Versions
Versions up to 7.33.1
Next Step
Update to 7.34 or newer if supported.
Review CVE-2025-13145 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-12732
CVE-2025-12732: WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting() function in all versions up to, and including, 7.33. This makes it possible for aut...

Published
Nov 11, 2025
Patched Release
7.33.1
Affected Versions
Versions up to 7.33
Next Step
Update to 7.33.1 or newer if supported.
Review CVE-2025-12732 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-10057
CVE-2025-10057: WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the write_to_customfile() function writing unfiltered PHP code to a file. This makes it possible for auth...

Published
Sep 16, 2025
Patched Release
7.29
Affected Versions
7.20 through 7.28
Next Step
Update to 7.29 or newer if supported.
Review CVE-2025-10057 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-10058
CVE-2025-10058: WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_function() function in all versions up to, and including, 7.27. This makes it possible for authenticated at...

Published
Sep 16, 2025
Patched Release
7.28
Affected Versions
Versions up to 7.27
Next Step
Update to 7.28 or newer if supported.
Review CVE-2025-10058 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-10040
CVE-2025-10040: WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and including, 7.27. This makes it possible for authenticated at...

Published
Sep 09, 2025
Patched Release
7.28
Affected Versions
Versions up to 7.27
Next Step
Update to 7.28 or newer if supported.
Review CVE-2025-10040 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-2008
CVE-2025-2008: Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload

The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attac...

Published
Mar 31, 2025
Patched Release
7.19.1
Affected Versions
Versions up to 7.19
Next Step
Update to 7.19.1 or newer if supported.
Review CVE-2025-2008 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-2007
CVE-2025-2007: Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion

The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, wi...

Published
Mar 25, 2025
Patched Release
7.19.1
Affected Versions
Versions up to 7.19
Next Step
Update to 7.19.1 or newer if supported.
Review CVE-2025-2007 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2023-4141
CVE-2023-4141: WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access i...

Published
Aug 03, 2023
Patched Release
7.9.9
Affected Versions
Versions up to 7.9.8
Next Step
Update to 7.9.9 or newer if supported.
Review CVE-2023-4141 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2023-4139
CVE-2023-4139: WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and v...

Published
Aug 03, 2023
Patched Release
7.9.9
Affected Versions
Versions up to 7.9.8
Next Step
Update to 7.9.9 or newer if supported.
Review CVE-2023-4139 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2023-4142
CVE-2023-4142: WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access i...

Published
Aug 03, 2023
Patched Release
7.9.9
Affected Versions
Versions up to 7.9.8
Next Step
Update to 7.9.9 or newer if supported.
Review CVE-2023-4142 fixed version details Open CVE Reference