Smackcoders WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress

• CVE-2026-1317 Medium 6.5 WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name 0.3%
• CVE-2025-14627 Medium 6.4 WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass 0.3%
• CVE-2025-13145 High 7.2 WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import 0.6%
• CVE-2025-12732 Medium 4.3 WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure 0.3%
• CVE-2025-10058 High 8.1 WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion 0.6%
• CVE-2025-10040 High 7.7 WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure 0.3%
• CVE-2025-2008 High 8.8 Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload 1.2%
• CVE-2025-2007 High 8.1 Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion 1.2%
• CVE-2023-4142 High 8.0 WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution 1.6%
• CVE-2023-4141 High 8.0 WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution 1.6%
• CVE-2023-4139 High 7.5 WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing 0.7%
• CVE-2023-4140 Medium 6.6 WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation 0.8%