WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Export All URLs

Export post, page and custom post type data to CSV or JSON, and snapshot your site to detect added, removed or changed content.

7Reported vulnerabilities
7.5Highest CVSS score
6.0Latest version
50,000+Active installs

What to do now

Update Export All URLs to 5.1 or later. 7 of these have a fixed version available. Updating resolves them.

Plugin last updated: June 25, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2022-2638 Medium 6.5 1.1% Before 4.4 4.4 August 29, 2022
CVE-2022-0914 Medium 6.5 0.6% Before 4.3 4.3 April 11, 2022
CVE-2023-3118 Medium 6.1 0.6% Before 4.6 4.6 July 10, 2023
CVE-2022-0892 Medium 6.1 0.8% Before 4.2 4.2 April 11, 2022
CVE-2026-2696 High 7.5 0.3% Before 5.1 5.1 April 2, 2026
CVE-2022-27856 Medium 6.4 0.4% 4.1 and earlier 4.2 May 27, 2022
CVE-2022-29452 Medium 4.8 0.5% 4.1 and earlier 4.2 June 15, 2022

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.