WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel

Information

Software Type Plugin
Software Slug wp-ultimate-csv-importer (view on wordpress.org)
Software Status Active
Software Author smackcoders
Software Website www.smackcoders.com
Software Downloads 2,273,498
Software Active Installs 20,000
Software Record Last Updated July 21, 2026

Showing 1-20 of 27 Vulnerabilities

Submit a Vulnerability
WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter
8.8
CVE-2026-13353
Jul 10, 2026
Researcher: daroo
WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name
6.5
CVE-2026-1317
Feb 17, 2026
Researchers: Dieu Link, GCSC Vietnam
WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass
6.4
CVE-2025-14627
Jan 1, 2026
Researchers: Dieu Link, GCSC Vietnam
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import
7.2
CVE-2025-13145
Nov 18, 2025
Researchers: Dieu Link, GCSC Vietnam
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure
4.3
CVE-2025-12732
Nov 11, 2025
Researcher: type5afe
WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection
8.8
CVE-2025-10057
Sep 16, 2025
Researcher: Arkadiusz Hydzik
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVE-2025-10058
Sep 16, 2025
Researcher: Arkadiusz Hydzik
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure
7.7
CVE-2025-10040
Sep 9, 2025
Researcher: Arkadiusz Hydzik
Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-2025-2008
Mar 31, 2025
Researcher: mikemyers
Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVE-2025-2007
Mar 25, 2025
Researcher: mikemyers
WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation
6.6
CVE-2023-4140
Aug 3, 2023
Researcher: István Márton
WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution
8.0
CVE-2023-4142
Aug 3, 2023
Researcher: István Márton
WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution
8.0
CVE-2023-4141
Aug 3, 2023
Researcher: István Márton
WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing
7.5
CVE-2023-4139
Aug 3, 2023
Researcher: István Márton
WP Ultimate CSV Importer <= 6.5.7 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2022-3243
Sep 20, 2022
Researcher: Sanjay Das Payatu
WP Ultimate CSV Importer <= 6.5.7 - Missing Authorization
5.4
CVE-2022-3244
Sep 20, 2022
Researcher: Sanjay Das Payatu
WP Ultimate CSV Importer <= 6.5.2 - Server-Side Request Forgery
4.1
CVE-2022-1977
Jun 2, 2022
Researcher: Luan Pedersini
WP Ultimate CSV Importer <= 6.4.2 - Admin+ Stored Cross-Site Scripting
4.8
CVE-2022-0360
Jan 26, 2022
Researcher: Felipe de Avila
Import all XML, CSV & TXT into WordPress < 6.4.2 - Missing Authorization
7.1
CVE ID Unknown
Jan 17, 2022
Researcher: WPScanTeam
WP Ultimate CSV Importer <= 6.4.0 - Arbitrary File Upload
8.8
CVE ID Unknown
Jan 12, 2022
Researchers:
Title Status CVE ID CVSS Researchers Date
WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter Patched CVE-2026-13353 8.8 daroo July 10, 2026
WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name Patched CVE-2026-1317 6.5 Dieu Link, GCSC Vietnam February 17, 2026
WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass Patched CVE-2025-14627 6.4 Dieu Link, GCSC Vietnam January 1, 2026
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import Patched CVE-2025-13145 7.2 Dieu Link, GCSC Vietnam November 18, 2025
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure Patched CVE-2025-12732 4.3 type5afe November 11, 2025
WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection Patched CVE-2025-10057 8.8 Arkadiusz Hydzik September 16, 2025
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion Patched CVE-2025-10058 8.1 Arkadiusz Hydzik September 16, 2025
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure Patched CVE-2025-10040 7.7 Arkadiusz Hydzik September 9, 2025
Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload Patched CVE-2025-2008 8.8 mikemyers March 31, 2025
Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion Patched CVE-2025-2007 8.1 mikemyers March 25, 2025
WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation Patched CVE-2023-4140 6.6 István Márton August 3, 2023
WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution Patched CVE-2023-4142 8.0 István Márton August 3, 2023
WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution Patched CVE-2023-4141 8.0 István Márton August 3, 2023
WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing Patched CVE-2023-4139 7.5 István Márton August 3, 2023
WP Ultimate CSV Importer <= 6.5.7 - Authenticated (Administrator+) SQL Injection Patched CVE-2022-3243 7.2 Sanjay Das Payatu September 20, 2022
WP Ultimate CSV Importer <= 6.5.7 - Missing Authorization Patched CVE-2022-3244 5.4 Sanjay Das Payatu September 20, 2022
WP Ultimate CSV Importer <= 6.5.2 - Server-Side Request Forgery Patched CVE-2022-1977 4.1 Luan Pedersini June 2, 2022
WP Ultimate CSV Importer <= 6.4.2 - Admin+ Stored Cross-Site Scripting Patched CVE-2022-0360 4.8 Felipe de Avila January 26, 2022
Import all XML, CSV & TXT into WordPress < 6.4.2 - Missing Authorization Patched 7.1 WPScanTeam January 17, 2022
WP Ultimate CSV Importer <= 6.4.0 - Arbitrary File Upload Patched 8.8 January 12, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation