WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

Information

Software Type Plugin
Software Slug wp-all-import (view on wordpress.org)
Software Status Active
Software Author wpallimport
Software Website www.wpallimport.com
Software Downloads 5,490,342
Software Active Installs 100,000
Software Record Last Updated July 19, 2026

Showing 1-20 of 23 Vulnerabilities

Submit a Vulnerability
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2026-57628
Jun 26, 2026
Researcher: Ananda Dhakal
WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'
6.1
CVE-2026-2830
Mar 5, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic
8.8
CVE-2025-12733
Nov 12, 2025
Researcher: tmrswrr
Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload
7.2
CVE-2025-10001
Sep 9, 2025
Researcher: Nguyen Truong (Roll)
Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel)
3.7
CVE-2014-2054
Apr 7, 2025
Researchers:
Import any XML or CSV File to WordPress <= 3.7.3 - Cross-Site Request Forgery to Notice Dismissal
4.3
CVE-2024-31939
Apr 10, 2024
Researcher: Dhabaleshwar Das
Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload
7.2
CVE-2023-7082
Dec 29, 2023
Researcher: quangnt
Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal
6.5
CVE-2022-2711
Oct 17, 2022
Researcher: lucy
Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload
6.5
CVE-2022-3418
Oct 17, 2022
Researcher: lucy
WP All Import <= 3.6.7 - Admin+ Arbitrary File Upload
4.8
CVE-2022-2268
Jul 1, 2022
Researcher: moresec
Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
7.2
CVE-2022-1565
Jun 30, 2022
Researcher: yangkang
WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution
9.1
CVE-2022-36386
Jun 28, 2022
Researcher: Universe
Import any XML or CSV File to WordPress <= 3.6.6 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Jun 2, 2022
Researchers:
Import any XML or CSV File to WordPress <= 3.6.2 - Authenticated Stored Cross-Site Scripting
4.8
CVE-2021-24714
Nov 2, 2021
Researcher: Huy Nguyen
Import any XML or CSV File to WordPress <= 3.2.4 - Missing Authorization and Cross-Site Request Forgery Checks
6.3
CVE ID Unknown
Feb 19, 2020
Researcher: Kacper Szurek
Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection
7.2
CVE ID Unknown
Feb 19, 2020
Researcher: Kacper Szurek
Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks
7.5
CVE-2015-9331
Aug 20, 2019
Researchers: James Golovich, Ibrahim Raafat
WP All Import <= 3.4.5 - Cross-Site Scripting
6.1
CVE-2018-0546
Mar 8, 2018
Researcher: Mardan Muhidin
WP All Import <= 3.4.6 - Cross-Site Scripting
6.1
CVE-2018-0547
Mar 8, 2018
Researcher: Yuji Tounai
Import any XML or CSV File to WordPress <= 3.4.6 - Cross-Site Scripting
6.1
CVE-2018-20978
Mar 7, 2018
Researcher: Mardan Muhidin
Title Status CVE ID CVSS Researchers Date
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 - Authenticated (Administrator+) SQL Injection Patched CVE-2026-57628 4.9 Ananda Dhakal June 26, 2026
WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath' Patched CVE-2026-2830 6.1 Osvaldo Noe Gonzalez Del Rio (Os) March 5, 2026
Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic Patched CVE-2025-12733 8.8 tmrswrr November 12, 2025
Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload Patched CVE-2025-10001 7.2 Nguyen Truong (Roll) September 9, 2025
Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel) Patched CVE-2014-2054 3.7 April 7, 2025
Import any XML or CSV File to WordPress <= 3.7.3 - Cross-Site Request Forgery to Notice Dismissal Patched CVE-2024-31939 4.3 Dhabaleshwar Das April 10, 2024
Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload Patched CVE-2023-7082 7.2 quangnt December 29, 2023
Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal Patched CVE-2022-2711 6.5 lucy October 17, 2022
Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload Patched CVE-2022-3418 6.5 lucy October 17, 2022
WP All Import <= 3.6.7 - Admin+ Arbitrary File Upload Patched CVE-2022-2268 4.8 moresec July 1, 2022
Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload Patched CVE-2022-1565 7.2 yangkang June 30, 2022
WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution Patched CVE-2022-36386 9.1 Universe June 28, 2022
Import any XML or CSV File to WordPress <= 3.6.6 - Reflected Cross-Site Scripting Patched 6.1 June 2, 2022
Import any XML or CSV File to WordPress <= 3.6.2 - Authenticated Stored Cross-Site Scripting Patched CVE-2021-24714 4.8 Huy Nguyen November 2, 2021
Import any XML or CSV File to WordPress <= 3.2.4 - Missing Authorization and Cross-Site Request Forgery Checks Patched 6.3 Kacper Szurek February 19, 2020
Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection Patched 7.2 Kacper Szurek February 19, 2020
Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks Patched CVE-2015-9331 7.5 James Golovich, Ibrahim Raafat August 20, 2019
WP All Import <= 3.4.5 - Cross-Site Scripting Patched CVE-2018-0546 6.1 Mardan Muhidin March 8, 2018
WP All Import <= 3.4.6 - Cross-Site Scripting Patched CVE-2018-0547 6.1 Yuji Tounai March 8, 2018
Import any XML or CSV File to WordPress <= 3.4.6 - Cross-Site Scripting Patched CVE-2018-20978 6.1 Mardan Muhidin March 7, 2018

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation