CVE-2026-2830

🗓️ 06 Mar 2026 07:22:51Reported by WordfenceType

CVE-2026-2830: WP All Import up to 4.0.0 has reflected XSS via filepath parameter enabling unauthenticated users to inject scripts.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-2830	6 Mar 202607:22	–	attackerkb
Circl	CVE-2026-2830	6 Mar 202608:49	–	circl
CNNVD	WordPress plugin WP All Import 代码注入漏洞	6 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-2830 WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'	6 Mar 202607:22	–	cvelist
EUVD	EUVD-2026-10004	6 Mar 202609:31	–	euvd
NVD	CVE-2026-2830	6 Mar 202608:16	–	nvd
Patchstack	WordPress WP All Import plugin <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath' vulnerability	6 Mar 202608:46	–	patchstack
Positive Technologies	PT-2026-23657	6 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-2830	7 Mar 202607:59	–	redhatcve
Vulnrichment	CVE-2026-2830 WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'	6 Mar 202607:22	–	vulnrichment

Vulners

Node

wpallimport wp_all_import_drag_&_drop_import_for_csv,_xml,_excel_&_google_sheetsRange≤4.0.0wordpress

[
  {
    "vendor": "wpallimport",
    "product": "WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.0.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/wp-all-import/trunk/libraries/XmlImportTemplateCodeGenerator.php
plugins	www.plugins.trac.wordpress.org/changeset/3474757/
plugins	www.plugins.trac.wordpress.org/browser/wp-all-import/trunk/controllers/admin/import.php
plugins	www.plugins.trac.wordpress.org/browser/wp-all-import/trunk/libraries/XmlImportTemplate.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/afc85535-962d-479d-8580-9d02f7412930

17 Jun 2026 10:31Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.1

EPSS0.00215

SSVC

CWE-94