Known vulnerabilities in WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import
Import CSV, XML and Excel files into WordPress. Bulk import posts, pages, WooCommerce products, users, ACF fields, images, custom post types and more.
28Reported vulnerabilities
8.8Highest CVSS score
9.1Latest version
20,000+Active installs
What to do now
Update WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import to 9.0 or later.
28 of these have a fixed version available. Updating resolves them.
Reported vulnerabilities
| CVE | Severity | Exploit probability |
Affected versions | Fixed in | Published |
|---|---|---|---|---|---|
| CVE-2022-1977 | High | 1.3% | Before 6.5.3 | 6.5.3 |
June 27, 2022 |
| CVE-2022-3243 | High | 1.1% | Before 6.5.8 | 6.5.8 |
October 17, 2022 |
| CVE-2023-4142 | High | 1.6% | 7.9.8 and earlier | 7.9.9 |
August 4, 2023 |
| CVE-2023-4141 | High | 1.6% | 7.9.8 and earlier | 7.9.9 |
August 4, 2023 |
| CVE-2026-13353 | High | 1.1% | 0 to 8.0.1 (inclusive) | 8.1 |
July 11, 2026 |
| CVE-2025-2008 | High | 1.2% | 0 to 7.19 (inclusive) | 7.19.1 |
April 1, 2025 |
| CVE-2023-4140 | High | 0.8% | 7.9.8 and earlier | 7.9.9 |
August 4, 2023 |
| CVE-2025-10057 | High | 0.7% | 7.20 to 7.28 (inclusive) | 7.29 |
September 17, 2025 |
| CVE-2015-10125 | High | 0.4% | Before 3.7.3 | 3.7.3 |
October 5, 2023 |
| CVE-2022-0360 | Medium | 0.6% | Before 6.4.3 | 6.4.3 |
February 28, 2022 |
| CVE-2018-20967 | High | 0.6% | Before 5.6.1 | 5.6.1 |
August 14, 2019 |
| WF-d21bebcc-8dba-407d-8a3a-b91d3cddd38f | High | — | 6.4.0 and earlier | 6.4.1 |
January 12, 2022 |
| CVE-2025-2007 | High | 1.2% | 0 to 7.19 (inclusive) | 7.19.1 |
April 1, 2025 |
| CVE-2025-10058 | High | 0.6% | 0 to 7.27 (inclusive) | 7.28 |
September 17, 2025 |
| CVE-2022-3244 | Medium | 0.4% | Before 6.5.8 | 6.5.8 |
October 17, 2022 |
| CVE-2025-10040 | High | 0.3% | 0 to 7.27 (inclusive) | 7.28 |
September 10, 2025 |
| CVE-2023-4139 | High | 0.7% | 7.9.8 and earlier | 7.9.9 |
August 4, 2023 |
| WF-0d50f217-7a53-49bf-9ce9-9922d0b3e18b | High | — | 3.7 and earlier | 3.7.1 |
April 27, 2015 |
| WF-7a46c049-367d-4a67-9607-c74ef0b96c71 | High | — | Before 3.6.75 | 3.6.75 |
February 22, 2015 |
| CVE-2025-13145 | High | 0.5% | 0 to 7.33.1 (inclusive) | 7.34 |
November 19, 2025 |
| WF-69725919-490c-4357-872c-d8112af5fe40 | High | — | 6.4.1 and earlier | 6.4.2 |
January 17, 2022 |
| CVE-2026-1317 | Medium | 0.2% | 0 to 7.37 (inclusive) | 7.38 |
February 18, 2026 |
| CVE-2025-14627 | Medium | 0.3% | 0 to 7.35 (inclusive) | 7.36 |
January 1, 2026 |
| WF-391ef7e0-d4e6-4c2e-b15e-65bdba190b69 | Medium | — | Before 6.4.1 | 6.4.1 |
January 12, 2022 |
| CVE-2015-9306 | Medium | 1.0% | Before 3.8.1 | 3.8.1 |
August 12, 2019 |
| WF-45ba8203-a8a0-4330-a264-c2f555d09ef0 | Medium | — | Before 3.8.8 | 3.8.8 |
January 27, 2018 |
| CVE-2026-80488 | Medium | 0.2% | Before 9.0 | 9.0 |
August 29, 2026 |
| CVE-2025-12732 | Medium | 0.3% | 0 to 7.33 (inclusive) | 7.33.1 |
November 12, 2025 |