Smackcoders vulnerabilities
We track 23 vulnerabilities in Smackcoders products across 11 products. 23 are rated high or critical, and none are known to be exploited. The most recent was published on October 5, 2026.
Latest Smackcoders vulnerabilities
- 7.2 High severity
WP Ultimate Exporter: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
- 8.8 High severity
WP Ultimate CSV Importer – WordPress Import &…: Improper Control of Generation of Code
The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capability checks on
- 7.2 High severity
WP Ultimate CSV Importer – Import CSV, XML &…: Deserialization of Untrusted Data
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. This is due to deserialization of untrusted data supplied via CSV file imports in the import_single
- 8.1 High severity
WP Ultimate CSV Importer – Import CSV, XML &…: External Control of File Name or Path
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_function() function in all versions up to, and including, 7.27. This makes it possible
- 8.8 High severity
WP Import – Ultimate CSV XML Importer for…: Improper Control of Generation of Code
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the write_to_customfile() function writing unfiltered PHP code to a file. This makes
- 7.7 High severity
WP Ultimate CSV Importer – Import CSV, XML &…: Missing Authorization
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and including, 7.27. This makes it possible
- 8.1 High severity
WordPress Helpdesk Integration: Improper Control of Filename for Include/Require Statement in PHP Program
The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portal_type parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php
- 8.8 High severity
Lead Form Data Collection to CRM: Missing Authorization
Missing Authorization vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Privilege Escalation.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.1.
- 8.8 High severity
WP Ultimate CSV Importer – Import CSV, XML &…: Unrestricted Upload of File with Dangerous Type
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for
- 8.1 High severity
WP Ultimate CSV Importer – Import CSV, XML &…: Relative Path Traversal
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authent
- 8.5 High severity
Lead Form Data Collection to CRM: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Blind SQL Injection.This issue affects Lead Form Data Collection to CRM: fr
- 9.8 Critical severity
Export All Posts, Products, Orders, Refunds &…: Deserialization of Untrusted Data
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 via deserialization of untrusted input in the 'returnMetaValueAsCustomerInput' function. This makes it
- 7.5 High severity
Export All Posts, Products, Orders, Refunds &…: Insecure Storage of Sensitive Information
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract
- 9.1 Critical severity
WP Ultimate Exporter: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows PHP Remote File Inclusion.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.1.
- 9.8 Critical severity
SendGrid for WordPress: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress allows SQL Injection.This issue affects SendGrid for WordPress: from n/a through 1.4.
- 7.5 High severity
Export All Posts, Products, Orders, Refunds &…: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
- 7.5 High severity
Export All Posts, Products, Orders, Refunds &…: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
- 8.8 High severity
WP Ultimate CSV Importer – Import CSV, XML &…: Improper Control of Generation of Code
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previo
- 8.8 High severity
WP Ultimate CSV Importer – Import CSV, XML &…: Improper Control of Generation of Code
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previo
- 8.8 High severity
WP Ultimate CSV Importer – Import CSV, XML &…: Improper Privilege Management
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minima
- 7.5 High severity
WP Ultimate CSV Importer – Import CSV, XML &…: Exposure of Sensitive Information to an Unauthorized Actor
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated att
- 7.2 High severity
Import all XML, CSV & TXT into WordPress: Improper Neutralization of Special Elements used in an SQL Command
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin
- 7.2 High severity
Import Export All WordPress Images, Users &…: Server-Side Request Forgery
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF