Plugin icon

WP Import Export Lite

wp-import-export-lite

Vulnerabilities:

18

Last Updated:

September 12, 2026

Active Installs:

40000

Published
Title
Fixed in
CVSS
Published
2026-09-17
Title
WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import
Fixed in
Fixed in 3.9.35
CVSS
7.2 (high)
Published
2026-09-14
Title
WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import
Fixed in
Fixed in 3.9.33
CVSS
7.2 (high)
Published
2026-09-14
Title
WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names
Fixed in
Fixed in 3.9.33
CVSS
6.8 (medium)
Published
2026-09-14
Title
WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function
Fixed in
Fixed in 3.9.33
CVSS
7.2 (high)
Published
2026-09-14
Title
WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules
Fixed in
Fixed in 3.9.33
CVSS
6.8 (medium)
Published
2026-09-14
Title
WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template Path Traversal
Fixed in
Fixed in 3.9.33
CVSS
6.5 (medium)
Published
2026-09-14
Title
WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal
Fixed in
Fixed in 3.9.34
CVSS
7.2 (high)
Published
2026-09-14
Title
WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal
Fixed in
Fixed in 3.9.33
CVSS
6.8 (medium)
Published
2026-09-14
Title
WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling
Fixed in
Fixed in 3.9.33
CVSS
4.1 (medium)
Published
2026-09-14
Title
WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options
Fixed in
Fixed in 3.9.33
CVSS
6.8 (medium)
Published
2026-07-02
Title
WP Import Export Lite < 3.9.31 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter
Fixed in
Fixed in 3.9.31
CVSS
5.5 (medium)
Published
2025-08-04
Title
WP Import Export Lite < 3.9.30 - Authenticated (Subscriber+) Arbitrary File Upload
Fixed in
Fixed in 3.9.30
CVSS
7.5 (high)
Published
2025-08-04
Title
WP Import Export Lite < 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload
Fixed in
Fixed in 3.9.29
CVSS
7.5 (high)
Published
2025-04-21
Title
WP Import Export Lite < 3.9.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Fixed in
Fixed in 3.9.28
CVSS
6.4 (medium)
Published
2024-04-05
Title
WP Import Export Lite < 3.9.27 - Authenticated (Administrator+) PHP Object Injection
Fixed in
Fixed in 3.9.27
CVSS
7.2 (high)
Published
2022-01-14
Title
WP Import Export < 3.9.16 - Unauthenticated Sensitive Data Disclosure
Fixed in
Fixed in 3.9.16
CVSS
7.5 (high)
Published
2021-09-20
Title
WP Import Export Lite < 3.9.5 - Subscriber+ Extensions Update
Fixed in
Fixed in 3.9.5
CVSS
5.4 (medium)
Published
2021-09-20
Title
WP Import Export Lite < 3.9.5 - Subscriber+ Arbitrary Blog Options Update
Fixed in
Fixed in 3.9.5
CVSS
8.1 (high)