CVE-2026-120554High 8.8Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save0.6%
CVE-2026-17001Medium 6.4Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields0.2%
CVE-2026-86583High 8.8Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields0.4%
CVE-2026-15026Medium 4.3Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action0.4%
CVE-2026-7641High 8.8Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields0.7%
CVE-2026-3629High 8.1Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields0.4%
CVE-2024-4656Medium 4.4Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting0.3%
CVE-2024-4734Medium 4.4Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting0.3%
CVE-2024-1050Medium 4.3Import and export users and customers <= 1.26.5 - Missing Authorization0.4%
CVE-2023-6583Medium 6.6Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality0.8%
CVE-2023-6624Medium 4.9Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode0.3%