WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets vulnerabilities

Known security issues in the WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: wp-all-import
Latest version: 4.1.3
Active installs: 100,000+
Known vulnerabilities: 34
Data updated: 2026-10-18 10:09 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 4.1.0 (1)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 4.1.0
Vulnerability	Severity	CVSS	Affected versions	Published
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 - Authenticated (Administrator+) SQL Injection CVE-2026-57628 · Source	High	7.6	< 4.1.0	2026-06-26

Fixed in version 4.0.1 (1)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 4.0.1
Vulnerability	Severity	CVSS	Affected versions	Published
WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath' CVE-2026-2830 · Source	Not rated	-	< 4.0.1	0000-00-00

Fixed in version 4.0.0 (1)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 4.0.0
Vulnerability	Severity	CVSS	Affected versions	Published
Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic CVE-2025-12733 · Source	High	8.8	< 4.0.0	2025-11-12

Fixed in version 3.9.4 (1)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.9.4
Vulnerability	Severity	CVSS	Affected versions	Published
Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload CVE-2025-10001 · Source	High	7.2	< 3.9.4	2025-09-09

Fixed in version 3.9.0 (1)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.9.0
Vulnerability	Severity	CVSS	Affected versions	Published
Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel) CVE-2014-2054 · Source	Low	0.0	< 3.9.0	2014-06-04

Fixed in version 3.8.0 (1)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.8.0
Vulnerability	Severity	CVSS	Affected versions	Published
WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion CVE-2024-9661 · Source	Medium	4.3	< 3.8.0	0000-00-00

Fixed in version 3.7.4 (1)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.7.4
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Import any XML or CSV File to WordPress Plugin <= 3.7.3 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2024-31939 · Source	Medium	4.3	< 3.7.4	2024-04-10

Fixed in version 3.7.3 (1)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.7.3
Vulnerability	Severity	CVSS	Affected versions	Published
Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload CVE-2023-7082 · Source	High	7.2	< 3.7.3	2023-12-29

Fixed in version 3.6.9 (2)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.6.9
Vulnerability	Severity	CVSS	Affected versions	Published
Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload CVE-2022-3418 · Source	High	7.2	< 3.6.9	2022-10-17
Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal CVE-2022-2711 · Source	High	7.2	< 3.6.9	2022-10-17

Fixed in version 3.6.8 (3)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.6.8
Vulnerability	Severity	CVSS	Affected versions	Published
WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution CVE-2022-36386 · Source	Critical	9.1	< 3.6.8	2022-06-28
WP All Import <= 3.6.7 - Admin+ Arbitrary File Upload CVE-2022-2268 · Source	High	7.2	< 3.6.8	2022-07-01
WordPress Import any XML or CSV File to WordPress <= 3.6.7 - Authenticated Malicious File Upload vulnerability CVE-2022-1565 · Source	High	7.2	< 3.6.8	2022-06-30

Fixed in version 3.6.7 (1)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.6.7
Vulnerability	Severity	CVSS	Affected versions	Published
Import any XML or CSV File to WordPress <= 3.6.6 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.6.7	2022-06-02

Fixed in version 3.6.5 (1)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.6.5
Vulnerability	Severity	CVSS	Affected versions	Published
WP All Import < 3.6.5 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.6.5	-

Fixed in version 3.6.3 (1)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.6.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Import any XML or CSV File to WordPress plugin <= 3.6.2 - Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-24714 · Source	Medium	4.8	< 3.6.3	2021-11-02

Fixed in version 3.4.7 (2)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.4.7
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress plugin "WP All Import" vulnerable to cross-site scripting CVE-2018-0547 · Source	Medium	6.1	< 3.4.7	2018-03-08
Import any XML or CSV File to WordPress <= 3.4.6 - Cross-Site Scripting CVE-2018-20978 · Source	Medium	6.1	< 3.4.7	2018-03-07

Fixed in version 3.4.6 (3)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.4.6
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress plugin "WP All Import" vulnerable to cross-site scripting CVE-2018-0546 · Source	Medium	6.1	< 3.4.6	2018-03-08
Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting CVE-2017-18567 · Source	Medium	6.1	< 3.4.6	2017-10-08
WordPress Import any XML or CSV File to WordPress plugin <=3.4.5 - Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 3.4.6	2017-10-17

Fixed in version 3.2.5 (5)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.2.5
Vulnerability	Severity	CVSS	Affected versions	Published
Import any XML or CSV File to WordPress < 3.2.5 - SQL Injection CVE-2015-9330 · Source	Critical	9.8	< 3.2.5	2015-03-12
Import any XML or CSV File to WordPress <= 3.2.4 - Reflected Cross-Site Scripting CVE-2015-9329 · Source	Medium	6.1	< 3.2.5	2015-02-26
Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection No CVE assigned · Source	Not rated	-	< 3.2.5	2020-02-19
Import any XML or CSV File to WordPress <= 3.2.4 - Missing Authorization and Cross-Site Request Forgery Checks No CVE assigned · Source	Not rated	-	< 3.2.5	2020-02-19
WordPress WP All Import Plugin <= 3.2.4 - Multiple Vulnerabilities No CVE assigned · Source	Not rated	-	< 3.2.5	2015-03-17

Fixed in version 3.2.4 (2)

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Fixed in version 3.2.4
Vulnerability	Severity	CVSS	Affected versions	Published
Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks CVE-2015-9331 · Source	High	7.5	< 3.2.4	2019-08-20
WordPress WP All Import Plugin <= 3.2.3 - Remote Code Execution No CVE assigned · Source	Not rated	-	< 3.2.4	2015-02-26

Affects version 3.4.9 and earlier (6)

The source does not state the fixed version; versions after this one are not listed as affected.

WP All Import - Drag & Drop Import for CSV, XML, Excel & Google Sheets: Affects version 3.4.9 and earlier
Vulnerability	Severity	CVSS	Affected versions	Published
[en] There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. CVE-2018-16257 · Source	Medium	6.1	<= 3.4.9	2019-04-12
[en] There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. CVE-2018-16255 · Source	Medium	6.1	<= 3.4.9	2019-04-12
[en] There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. CVE-2018-16254 · Source	Medium	6.1	<= 3.4.9	2019-04-12
[en] There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). CVE-2018-16256 · Source	Medium	6.1	<= 3.4.9	2019-04-12
[en] There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. CVE-2018-16258 · Source	Medium	6.1	<= 3.4.9	2019-04-12
[en] There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. CVE-2018-16259 · Source	Medium	6.1	<= 3.4.9	2019-04-12

Check every plugin on your site automatically

Install the free Webforta Security plugin for WordPress and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.