Wpallimport vulnerabilities
We track 4 vulnerabilities in Wpallimport products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2025.
Latest Wpallimport vulnerabilities
- 8.8 High severity
WP All Import – Drag & Drop Import for CSV…: Improper Control of Generation of Code
The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if funct
- 7.2 High severity
WP All Import – Drag & Drop Import for CSV…: Unrestricted Upload of File with Dangerous Type
The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticate
- 7.2 High severity
Import Users from CSV: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2.
- 7.2 High severity
WP All Import – Drag & Drop Import for CSV…: Unrestricted Upload of File with Dangerous Type
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level per