Import Export Users EUVD-2026-101840

Exploitation requires an authenticated WordPress account with 'custom-level access and above' on a site running the Import and export users and customers plugin version ≤2.4.5, plus the ability to write to Custom Column User Meta Profile Fields through the plugin's import/export functionality. The payload is persistent and fires when any user - in practice a higher-privileged admin reviewing user/profile data - renders the affected page. Limiting factors: the required prior authentication (no anonymous/unauthenticated path), dependence on a victim subsequently accessing the injected page, and exposure limited to sites that both run this plugin and grant accounts to lower-trust users (e.g., membership, multi-author, or customer-facing stores); single-admin installs face negligible practical risk.

This is a moderate-severity stored XSS (CWE-79) with a Wordfence-assigned CVSS of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The signals point to a real-but-bounded risk rather than an urgent emergency. On the elevating side: the attack vector is network-based with low complexity, no user interaction is required to plant the payload, and the scope-change flag (S:C) plus persistent storage mean the injected script executes in the browser context of anyone (including higher-privileged admins) who later views the affected page - a classic privilege-escalation pathway. On the mitigating side: exploitation requires authenticated access at 'custom-level and above' (reflected in PR:L), so an attacker must already hold a valid, non-trivial account on the target site, which substantially narrows the opportunistic threat surface. No EPSS score was provided in the input and there is no CISA KEV listing, so there is no public exploitation signal; per the precision rules this is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. Net assessment: patch in the normal cycle (prioritizing multi-author / membership sites where low-trust accounts exist), but this is not a drop-everything issue absent evidence of active exploitation. Note one discrepancy to verify: stored XSS conventionally involves a victim viewing the payload, yet the vector records UI:N - Wordfence's standard convention treats passive victim access as UI:N, so do not read UI:N as 'zero victim involvement.'

An attacker holding a low-privileged but custom-capable account on a WordPress site running the Import and export users and customers plugin (≤2.4.5) injects a malicious script into a Custom Column User Meta Profile Field, which is stored without proper sanitization or output escaping. When a site administrator later opens the page rendering that user-meta data, the script executes in the admin's authenticated session, enabling session/cookie theft, admin-action forgery, or account takeover. No public exploit code was identified at time of analysis.