CVE-2026-45440

Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...

EUVD-2026-96456

Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...

CVE-2026-45440 WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability

Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...

CVE-2026-45440

The WP Ultimate CSV Importer plugin for WordPress, specifically versions

WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Ultimate CSV Importer versions = 9.2...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

CVE-2026-80517

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...

EUVD-2026-91935

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin (versions before 9.2 ) is vulnerable to unauthenticated data disclosure. The root cause is the failure to use a site-specific secret when deriving the storage location for import logs within the uploads directory , combined with a lack of direct acces...

EUVD-2026-91936

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

CVE-2026-80518 WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

CVE-2026-80517 WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...

CVE-2026-80517

The WP Ultimate CSV Importer WordPress plugin (versions before 9.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly validate file types within uploaded archives or sanitize their content before storing them in a publicly served location. This allows...

CVE-2026-80517 WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...

WordPress WP Ultimate CSV Importer plugin 7.17-9.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by kawagishi kouhei in WordPress Plugin WP Ultimate CSV Importer versions 7.17-9.1...

CVE-2026-80518 WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

PT-2026-104522

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.2 Description The plugin fails to use a site-specific secret when determining the storage location for import logs within the uploads directory. Additionally, it does not block direct access to thes...

PT-2026-104521

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.2 Description Insufficient validation of file types within uploaded archives and a lack of content sanitization before storage in a publicly accessible location allow high-privilege users to execute...

CVE-2026-80517: Improper Neutralization of Input During Web Page Generation

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...

CVE-2026-80518: Exposure of Sensitive Information to an Unauthorized Actor

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...