Wp Ultimate Csv Importer
Monthly
SQL injection in WP Ultimate CSV Importer 9.2 and earlier allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's import functionality, potentially exposing sensitive database contents. The CVSS 3.1 score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), requiring a high-privileged admin session with no user interaction; no public exploit identified at time of analysis. Real-world risk is limited to malicious administrators, compromised admin credentials, or attackers who first obtain an admin account, making this a high-CVSS but comparatively low-real-risk issue once the privilege requirement is factored in.
Unauthenticated information disclosure in the WP Ultimate CSV Importer WordPress plugin (versions before 9.2) lets remote attackers retrieve import-log files that contain the personal data of users previously imported from a CSV file, because the plugin derives the log storage path under the uploads directory without any site-specific secret and does not block direct web access to those files. Impact is bounded to low confidentiality (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N): no write or administrative access is obtained, and only data that was actually imported and written to still-present log files can be exposed. Publicly available exploit code exists, but EPSS is only 0.14% (3rd percentile) and the practical attack requires knowing or guessing the non-random file path and depends on a prior sensitive import having occurred; the vendor has released a fix in version 9.2.
Stored cross-site scripting in the WordPress plugin WP Ultimate CSV Importer (versions 7.17 up to, but not including, 9.2) allows an authenticated high-privilege user such as an Administrator to upload an archive whose contained files are neither type-validated nor sanitized, and which are then written to a publicly served location where they execute in the browser session of anyone who views them. The most serious configuration is WordPress Multisite, where a subsite Administrator does not hold the unfiltered_html capability, so the injected script can run in the session of a Network Super Administrator and cross a privilege boundary. Exploitation requires an authenticated Administrator-level account plus a victim who views the stored file (UI:R), publicly available exploit code exists, but EPSS is only 0.15% (4th percentile) and there is no CISA KEV confirmation of active exploitation; overall this is a low-severity, low-priority issue, with a vendor patch available in version 9.2.
WP Ultimate CSV Importer plugin for WordPress, through version 9.1, exposes embedded sensitive data to unauthenticated network attackers. The plugin inserts sensitive information into sent data, allowing retrieval of partial confidential information without authentication, user interaction, or special configuration. The impact is confidentiality-only and low-to-moderate, with no public exploit code identified at time of analysis.
SQL injection in WP Ultimate CSV Importer WordPress plugin (versions before 9.0) allows authenticated administrators to extract database contents by supplying crafted field values in CSV imports that are passed unsanitized into SQL statements. A publicly available proof-of-concept exists per the WPScan advisory, though the EPSS score of 0.16% (5th percentile) indicates minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the administrative privilege requirement substantially narrows the realistic attack surface.
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
SQL injection in WP Ultimate CSV Importer 9.2 and earlier allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's import functionality, potentially exposing sensitive database contents. The CVSS 3.1 score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), requiring a high-privileged admin session with no user interaction; no public exploit identified at time of analysis. Real-world risk is limited to malicious administrators, compromised admin credentials, or attackers who first obtain an admin account, making this a high-CVSS but comparatively low-real-risk issue once the privilege requirement is factored in.
Unauthenticated information disclosure in the WP Ultimate CSV Importer WordPress plugin (versions before 9.2) lets remote attackers retrieve import-log files that contain the personal data of users previously imported from a CSV file, because the plugin derives the log storage path under the uploads directory without any site-specific secret and does not block direct web access to those files. Impact is bounded to low confidentiality (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N): no write or administrative access is obtained, and only data that was actually imported and written to still-present log files can be exposed. Publicly available exploit code exists, but EPSS is only 0.14% (3rd percentile) and the practical attack requires knowing or guessing the non-random file path and depends on a prior sensitive import having occurred; the vendor has released a fix in version 9.2.
Stored cross-site scripting in the WordPress plugin WP Ultimate CSV Importer (versions 7.17 up to, but not including, 9.2) allows an authenticated high-privilege user such as an Administrator to upload an archive whose contained files are neither type-validated nor sanitized, and which are then written to a publicly served location where they execute in the browser session of anyone who views them. The most serious configuration is WordPress Multisite, where a subsite Administrator does not hold the unfiltered_html capability, so the injected script can run in the session of a Network Super Administrator and cross a privilege boundary. Exploitation requires an authenticated Administrator-level account plus a victim who views the stored file (UI:R), publicly available exploit code exists, but EPSS is only 0.15% (4th percentile) and there is no CISA KEV confirmation of active exploitation; overall this is a low-severity, low-priority issue, with a vendor patch available in version 9.2.
WP Ultimate CSV Importer plugin for WordPress, through version 9.1, exposes embedded sensitive data to unauthenticated network attackers. The plugin inserts sensitive information into sent data, allowing retrieval of partial confidential information without authentication, user interaction, or special configuration. The impact is confidentiality-only and low-to-moderate, with no public exploit code identified at time of analysis.
SQL injection in WP Ultimate CSV Importer WordPress plugin (versions before 9.0) allows authenticated administrators to extract database contents by supplying crafted field values in CSV imports that are passed unsanitized into SQL statements. A publicly available proof-of-concept exists per the WPScan advisory, though the EPSS score of 0.16% (5th percentile) indicates minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the administrative privilege requirement substantially narrows the realistic attack surface.
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.