Plugin icon

Import and export users and customers

import-users-from-csv-with-meta

Vulnerabilities:

18

Last Updated:

December 3, 2025

Active Installs:

80000

Published
Title
Fixed in
CVSS
Published
2025-01-27
Title
Import and export users and customers < 1.27.13 - Unauthenticated Sensitive Information Disclosure
Fixed in
Fixed in 1.27.13
CVSS
5.3 (medium)
Published
2024-10-24
Title
Import and export users and customers < 1.27.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.27.6
CVSS
4.4 (medium)
Published
2024-08-07
Title
Import and export users and customers < 1.26.9 - Unauthenticated Information Exposure
Fixed in
Fixed in 1.26.9
CVSS
5.3 (medium)
Published
2024-05-14
Title
Import and export users and customers < 1.26.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.26.7
CVSS
4.4 (medium)
Published
2024-05-14
Title
Import and export users and customers < 1.26.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.26.7
CVSS
4.4 (medium)
Published
2024-05-03
Title
Import and export users and customers < 1.26.6 - Missing Authorization
Fixed in
Fixed in 1.26.6
CVSS
4.3 (medium)
Published
2024-04-22
Title
Import and export users and customers < 1.26.3 - Authenticated (Admin+) PHP Object Injection
Fixed in
Fixed in 1.26.3
CVSS
7.2 (high)
Published
2024-01-16
Title
Import and export users and customers < 1.24.7 - Missing Authorization via fire_cron REST endpoint
Fixed in
Fixed in 1.24.7
CVSS
5.3 (medium)
Published
2023-12-11
Title
Import and export users and customers < 1.24.4 - Contributor+ Stored XSS
Fixed in
Fixed in 1.24.4
CVSS
5.1 (medium)
Published
2023-12-08
Title
Import and export users and customers < 1.24.3 - Admin+ Arbitrary File Read/Deletion
Fixed in
Fixed in 1.24.3
CVSS
5.9 (medium)
Published
2022-10-17
Title
Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection
Fixed in
Fixed in 1.20.5
CVSS
4.1 (medium)
Published
2022-04-11
Title
Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 1.19.2.1
CVSS
3.4 (low)
Published
2020-11-20
Title
Import and export users and customers < 1.16.3.6 - CSV Injection
Fixed in
Fixed in 1.16.3.6
CVSS
6.1 (medium)
Published
2020-01-01
Title
Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export
Fixed in
Fixed in 1.15.0.1
CVSS
3.1 (low)
Published
2019-06-22
Title
Import users from CSV with meta < 1.14.2.2 - CSRF leading to attachment deletion & Path Traversal
Fixed in
Fixed in 1.14.2.2
CVSS
7.5 (high)
Published
2019-06-20
Title
Import users from CSV with meta <= 1.14.1.2 - XSS
Fixed in
Fixed in 1.14.1.3
CVSS
6.1 (medium)
Published
2019-03-14
Title
Import users from CSV with meta <= 1.14.0.2 - XSS and CSRF
Fixed in
Fixed in 1.14.0.3
CVSS
8.8 (high)
Published
2018-12-11
Title
Import users from CSV with meta <= 1.12 - Import Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.12.1
CVSS
6.1 (medium)