WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

Easily import any file of any size into any plugin, post type, custom field, or taxonomy. Supports WooCommerce, ACF, images, galleries, users, real es …

26Reported vulnerabilities
9.8Highest CVSS score
4.1.1Latest version
100,000+Active installs

What to do now

Update WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets to 4.1.0 or later. 20 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 16, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2022-1565 High 7.2 15.1% 3.6.7 and earlier 3.6.8 June 30, 2022
CVE-2022-2711 High 7.2 3.2% Before 3.6.9 3.6.9 November 7, 2022
CVE-2022-2268 High 7.2 1.4% Before 3.6.8 3.6.8 July 4, 2022
CVE-2023-7082 High 7.2 1.2% Before 3.7.3 3.7.3 January 22, 2024
CVE-2022-3418 High 7.2 1.1% Before 3.6.9 3.6.9 November 7, 2022
CVE-2015-9330 Critical 9.8 1.8% Before 3.2.5 3.2.5 August 20, 2019
CVE-2018-16256 Medium 6.1 0.9% 3.4.9 to 3.4.9 (inclusive) — April 12, 2019
CVE-2025-12733 High 8.8 0.6% 0 to 3.9.6 (inclusive) 4.0.0 November 13, 2025
CVE-2021-24714 Medium 4.8 0.6% Before 3.6.3 3.6.3 December 6, 2021
CVE-2015-9331 High 7.5 1.4% Before 3.2.4 3.2.4 August 20, 2019
CVE-2022-36386 High 7.2 1.2% 3.6.7 and earlier 3.6.8 September 21, 2022
CVE-2025-10001 High 7.2 0.6% 0 to 3.9.3 (inclusive) 3.9.4 September 10, 2025
CVE-2018-0547 Medium 6.1 1.5% 3.4.6 and earlier 3.4.7 March 9, 2018
CVE-2018-0546 Medium 6.1 1.5% Before 3.4.6 3.4.6 March 9, 2018
CVE-2018-20978 Medium 6.1 0.9% Before 3.4.7 3.4.7 August 20, 2019
CVE-2017-18567 Medium 6.1 0.9% Before 3.2.6 3.2.6 August 20, 2019
CVE-2015-9329 Medium 6.1 0.9% Before 3.2.5 3.2.5 August 20, 2019
CVE-2018-16259 Medium 6.1 0.9% 3.4.9 to 3.4.9 (inclusive) — April 12, 2019
CVE-2018-16258 Medium 6.1 0.9% 3.4.9 to 3.4.9 (inclusive) — April 12, 2019
CVE-2018-16257 Medium 6.1 0.9% 3.4.9 to 3.4.9 (inclusive) — April 12, 2019
CVE-2018-16255 Medium 6.1 0.9% 3.4.9 to 3.4.9 (inclusive) — April 12, 2019
CVE-2018-16254 Medium 6.1 0.9% 3.4.9 to 3.4.9 (inclusive) — April 12, 2019
CVE-2026-2830 Medium 6.1 0.2% 0 to 4.0.0 (inclusive) 4.0.1 March 6, 2026
WF-6c06b79a-0803-4973-ba88-b97d7145f82b Medium 6.1 — 3.6.6 and earlier 3.6.7 June 2, 2022
CVE-2026-57628 Medium 4.9 0.4% 4.0.1 and earlier 4.1.0 June 26, 2026
CVE-2024-31939 Medium 4.3 0.2% 3.7.3 and earlier 3.7.4 April 10, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.