SiteRespond
Scan

Software intelligence

Wp All Import vulnerabilities

23 tracked advisories · slug wp-all-import

Important: Wp All Import appearing in this catalog does not mean your website is affected. Exposure depends on your installed version. How SiteRespond intelligence works

Tracked advisories

23

Latest advisory

26 June 2026

CISA KEV matches

0

In this WordPress feed

WordPress slug

wp-all-import

Plugin

What this means for Wp All Import

This catalog lists 23 known advisories affecting Wp All Import. The most recent was published on 26 June 2026. If you use this software, compare your installed version against the affected ranges on each advisory and update to a fixed release outside those ranges. SiteRespond Defence checks your actual installed version when the plugin is connected — listing here does not by itself mean your site is vulnerable.

Latest issues

  • WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 - Authenticated (Administrator+) SQL Injection

    May allow attackers to read or modify database contents beyond intended access.

    Published 26 June 2026

  • WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'

    May allow attackers to run scripts in visitors' browsers or hijack admin sessions.

    Published 5 March 2026

  • Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic

    May allow attackers to run arbitrary code on the server if exploited.

    Published 12 November 2025

Vulnerability types

  • Cross-site scripting8
  • Remote code execution7
  • SQL injection3
  • CSRF2

Authentication (inferred from titles)

  • Unauthenticated0
  • Authenticated8
  • Unspecified15

Advisory history

Known Wp All Import advisories published by month.

All advisories

9–16 of 23

2 / 2

Check whether your installed version is affected

SiteRespond Defence matches your installed Wp All Import version against this catalog when the Defence plugin is connected to your WordPress site.

Start SiteRespond Defence for WordPress — £29.99/monthScan your website