Import Export Users CVE-2026-54862

Exploitation requires an authenticated account on the target WordPress site with enough privilege to reach the plugin's import/export user-and-customer functionality (CVSS PR:L), plus subsequent user interaction (UI:R) - a victim, typically an administrator or another user, must view the page where the payload is stored for the script to execute. The affected component is the 'Import and export users and customers' (import-users-from-csv-with-meta) plugin, versions up to and including 2.5.9. Limiting factors: it is not remote-unauthenticated (an account is needed), it does not self-trigger (it depends on a victim rendering the stored content), and the changed scope reflects execution in the victim's browser context rather than direct server compromise. The specific field or parameter carrying the unneutralized input is not described in the available sources.

This is a moderate-severity Stored Cross-Site Scripting flaw (CWE-79) in the Codection 'Import and export users and customers' WordPress plugin, scored CVSS 6.5. The provided CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) describes network-reachable, low-complexity exploitation but requires privileges (PR:L, i.e. an authenticated account) and victim user interaction (UI:R), with a changed scope (S:C) reflecting that injected script executes in another security context (the browser/session of whoever views the stored payload). The signals are mild rather than alarming: there is NO CISA KEV listing, NO EPSS score supplied, and NO verified working exploit - the single reference is a Patchstack database entry, not a proof-of-concept. The vulnerability was reported by Patchstack and carries a vuln.today priority Decision label of 'this_month', consistent with a real-but-not-emergency issue that should be remediated on a routine monthly patch cadence rather than treated as an active-exploitation fire drill. The combination of required authentication plus required user interaction meaningfully limits mass or opportunistic exploitation; this reads as a genuine but lower-tier priority, not a high-CVSS/low-real-risk false alarm nor a critical emergency.

A low-privileged authenticated user stores a malicious script payload through the plugin's user/customer import or export handling, which fails to neutralize input during web page generation. When an administrator or other user later views the affected page in wp-admin, the stored script executes in their browser session, potentially performing actions as that higher-privileged victim. No verified public exploit code is available, so an attacker would need to craft the payload themselves.