WP Ultimate CSV Importer EUVD-2026-91935

Exploitation requires an authenticated high-privilege account (Administrator, per PR:H) with access to the WP Ultimate CSV Importer's archive-upload import feature, which fails to validate file types inside the uploaded archive or sanitize their content before storing them in a publicly served location. A second user must then view the stored malicious file (UI:R), so the script executes in the victim's browser session rather than automatically. The most meaningful exposure is on Multisite installations, where a subsite Administrator does not hold the unfiltered_html capability - this configuration turns an otherwise ordinary admin-only XSS into a cross-privilege attack reaching Network Super Admins. Limiting factors: attacker must already be an administrator, victim interaction is mandatory, and plugin version must be between 7.17 and below 9.2.

This is a low-severity, low-priority issue despite being a cross-site scripting flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N, base 3.5) is internally consistent with the description: exploitation requires a high-privilege account (PR:H - an administrator) and victim interaction (UI:R - someone must view the stored file), which sharply limits real-world risk. The multi-source signals reinforce low priority: EPSS is only 0.15% (4th percentile), and the vulnerability is NOT on the CISA KEV list, indicating no confirmed active exploitation. Publicly available exploit code exists (via WPScan), which raises the floor on skill required but does not imply mass exploitation - POC availability and active exploitation are distinct signals. The one genuinely interesting nuance, surfaced by the description rather than the CVSS score, is the Multisite privilege-boundary crossing: a subsite Administrator lacks the unfiltered_html capability, so this flaw lets them inject script that executes in the session of Network Super Admins - effectively a privilege-escalation primitive that the S:U (unchanged scope) and low C:L/I:L ratings arguably understate. Net assessment: a real but low-priority bug for most single-site installs; marginally more significant on Multisite, but still gated behind administrator access and victim interaction.

On a WordPress Multisite install, a user with only subsite Administrator rights (who therefore lacks unfiltered_html) uploads a crafted archive to the WP Ultimate CSV Importer containing a file with malicious HTML/JavaScript that bypasses file-type and content validation and is stored in a publicly served location. When a Network Super Admin or other user later views that file, the embedded script executes in their authenticated session, enabling actions at a higher privilege level than the attacker holds. Public exploit code for this flaw is available via WPScan.