CVE-2026-76551 WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

EUVD-2026-80175

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution...

CVE-2026-76553 WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

CVE-2026-76552 WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remot...

CVE-2026-76550 WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution...

CVE-2026-76550

WP Import Export Lite WordPress plugin versions before 3.9.34 fail to validate a user-supplied output path when writing export files, an issue classified by Rapid7 as Improper Control of Generation of Code . Any user granted the plugin's export permission can write files with arbitrary names to a...

EUVD-2026-80177

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remot...

EUVD-2026-80176

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

EUVD-2026-80178

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

CVE-2026-76550 WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution...

CVE-2026-76551 WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

CVE-2026-76553

WP Import Export Lite WordPress plugin (versions before 3.9.33 ) contains an Authenticated Arbitrary Directory Deletion vulnerability discovered by mak3bread (Minseong Kim) . The plugin fails to validate a path taken from stored, user-supplied data before recursively deleting the resolved directo...

CVE-2026-76553 WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

CVE-2026-76558: Improper Neutralization of Input During Web Page Generation

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-76556: Improper Neutralization of Special Elements used in an SQL Command

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

CVE-2026-76553: External Control of File Name or Path

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

CVE-2026-73170: Improper Control of Generation of Code

Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a...

PT-2026-93282

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

PT-2026-93277

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

PT-2026-93276

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution...