Export All URLs

Export All URLs has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 7 are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high. 2022 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (57%). Other recurring categories include Cross-Site Request Forgery (CSRF), Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 7 issues recorded for Export All URLs has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (2) reported by Asif Nawaz Minhas. Export All URLs is installed on roughly 50,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage100%
Open

0

Fixed

7

Get automatic notifications for all Export All URLs vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2026-2696

Export All URLs < 5.1 - Unauthenticated Information Exposure

Read the full analysis

Vulnerability Records

7 records
Export All URLs banner
Latestv6.0

Export All URLs

Atlas Gondal

Author

Atlas Gondal

4.6(94)
92/100
Last Updated
2026-06-25 (3mo ago)
Active Installs
50,000+
Downloads
836,781
Requires WP
3.6+
Requires PHP
5.4+
Tested up to
WP 7.0.4
Created
2016-04-07 (11y ago)

This plugin will add a page called “Export All URLs” under Tools. You can navigate there and can extract data from your site. You can export Posts: ID Title URL Status Categories Category URLs Tags Tag URLs Author Published Date Modified Date Word Count Excerpt Featured Image URL Comment Count Slug Post Type Language (WPML / Polylang) Translation URLs (WPML / Polylang) Fields are organized into collapsible groups with quick-select presets, so the picker stays tidy even with this many columns. The data can be filtered by post type, post status, date range, and author before extraction, and the plugin also provides the option to export using a specific post range. Output can be displayed in the dashboard or downloaded as a CSV or JSON file. When we need this plugin? To check all URLs of your website During a migration (and to confirm everything was moved across) During a security audit, or to monitor the site for unauthorized or injected content (Snapshots) To share all URLs with your SEO consultant For handling 301 redirects in htaccess Customizable Features Choose exactly which columns to export, grouped with quick-select presets Download as CSV or JSON, or display the results in a paginated table Filter by post type, post status, author and date range Export a specific post range (helpful on very large sites) Exclude the domain from URLs (handy when comparing results after a migration) Multilingual support for WPML and Polylang (export all languages or just the default) Custom or randomly generated download file name Snapshots: capture your site and detect what was added, removed or changed over time System requirements PHP version 5.4 or higher WordPress version 3.6 or higher If you encounter any bugs, please report them to me, and I will strive to resolve them as quickly as possible! Contact For further information please send me an email.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C