Demo Importer Plus

Demo Importer Plus has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (40%). Other recurring categories include Cross-Site Scripting, Improper Restriction Of XML External Entity Reference.

Every one of the 5 issues recorded for Demo Importer Plus has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each. Demo Importer Plus is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSHigh

7.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Demo Importer Plus vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-14364

Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation

Read the full analysis

Vulnerability Records

5 records


2026-01-16 00:00	Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload Demo Importer Plus <= 2.0.9	`CVE-2025-14478`	7.5 High	bosz	Yes
2026-01-05 00:00	Demo Importer Plus <= 2.0.8 - Missing Authorization Demo Importer Plus <= 2.0.8	`CVE-2025-69091`	4.3 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2025-12-17 21:19	Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation Demo Importer Plus <= 2.0.8	`CVE-2025-14364`	8.8 High	shark3y	Yes
2025-12-04 14:25	Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass Demo Importer Plus <= 2.0.6	`CVE-2025-13066`	8.8 High	mikemyers	Yes
2024-10-01 19:35	Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Demo Importer Plus <= 2.0.1	`CVE-2024-9172`	6.4 Medium	Francesco Carlucci	Yes

Showing 1–5 of 5 reports

Latestv2.0.12

Demo Importer Plus

Author

Kraft Plugins

5.0(1)

100/100

Last Updated

2026-08-27 (17d ago)

Active Installs

10,000+

Downloads

349,288

Requires WP

4.7+

Requires PHP

7.4+

Tested up to

WP 6.8.8

Created

2021-06-12 (5y ago)

Demo Importer Plus is one of the best and powerful demo importer plugin. It allows to easily import the demo content, widgets, customizer settings along with theme settings with a single click. In addition to this, you can also import a single page template on your existing website. You can import the starter sites via Appearance > Demo Importer Plus. 2.0.12 Fix: Resolved an issue that caused duplicate pages to be imported. Fix: Corrected the primary package assignment for packages. 2.0.11 Fix: Color and price import issue has been solved. Fix: Automatic plugin activation issue has been solved. 2.0.10 Fix critical security vulnerability 2.0.9 Fix critical security vulnerability – Add authorization checks 2.0.8 Fix: Issue of svg not importing properly has been solved. 2.0.7 Fix arbitrary file upload vulnerability in WXR importer. 2.0.6 Fix: Templates list not showing due to json_decode issue has been solved. Fix: Warning shown due to translation loading early has been solved. 2.0.5 Fix: Add custom remote request method with enhanced cURL handling. 2.0.4 Fix: Add custom remote request method with enhanced cURL handling. 2.0.3 Fix: Delete previously imported demo content before importing new demo content not working issue is fixed. 2.0.2 Fix: XSS injection via SVG upload issue is fixed. 2.0.1 Fix: Resolved the issue of the demo site not importing on subdirectory installations. 2.0.0 Fix: Resolved frequent import cancellation issue. Optimization: Improved the import process flow with a new and enhanced UI. Optimization: Enhanced import speed for faster processing. Compatibility: Updated for WordPress version 6.6 compatibility. Other: Minor bug fixes and improvements. 1.2.2 Minor bug fixes. 1.2.1 WordPress version 6.5 update compatibility. 1.2.0 Fix: Site Importer Issues Optimization: Code Optimization Minor Bug Fixes 1.1.8 Fix: Multiple same requests while fetching and listing demo sites. 1.1.7 Minor Bug Fixes 1.1.6 Fix: Duplicate Post Meta issue Minor Bug Fixes 1.1.5 Compatibility: WP Travel Engine compatible while doing full site import Fix: Posts Category is not importing Enhancement: Parent terms mapping for taxonomy terms Fix: Missing Widgets on footer sidebars Minor Bug Fixes. 1.1.4 Minor Bug Fixes. 1.1.3 New API Enhancements. Minor Bug Fixes. 1.1.2 New API Enhancements. Minor Bug Fixes. 1.1.1 New Feature: Infinite Scroll for Demo Sites added. New API Enhancements. Minor Bug Fixes. 1.1.0 New Feature: Added Compatibility keys for PostsX Plugin Blocks and Widgets. New Feature: Added Onepage demo import support. Fixes: Fixed layout issue for demo importer screen. Minor Bug Fixes. 1.0.9 Added filter to allow icons import for Elementor. Minor Bug Fixes. 1.0.8 WordPress version 5.9 update compatibility. Minor Bug Fixes. 1.0.7 Minor Bug Fixes. 1.0.6 Minor Bug Fixes. 1.0.5 Minor Bug Fixes. 1.0.4 Minor Bug Fixes. API Updated for demo importer default website. 1.0.3 Minor Bug Fixes. 1.0.2 Minor Bug Fixes. Compatibility update for new themes added. 1.0.1 Filter added for dynamic API URL support on themes. Minor Bug Fixes. 1.0.0 Initial release.

View on WordPress.org