WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

Explore WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets vulnerabilities across all versions. Currently tracking 23 known vulnerabilities, including severity, impact, and patch status.

01234567891024.07.2012Today26.02.20156.1Import any XML or CSV File to WordPress <= 3.2.4 - Reflected Cross-Site Scripting CVSS 6.1 · 26.02.201512.03.20159.8Import any XML or CSV File to WordPress < 3.2.5 - SQL Injection CVSS 9.8 · 12.03.201508.10.20176.1Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting CVSS 6.1 · 08.10.201707.03.20186.1Import any XML or CSV File to WordPress <= 3.4.6 - Cross-Site Scripting CVSS 6.1 · 07.03.201808.03.20186.1WP All Import <= 3.4.5 - Cross-Site Scripting CVSS 6.1 · 08.03.20186.1WP All Import <= 3.4.6 - Cross-Site Scripting CVSS 6.1 · 08.03.201820.08.20197.5Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks CVSS 7.5 · 20.08.201919.02.20207.2Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection CVSS 7.2 · 19.02.20206.3Import any XML or CSV File to WordPress <= 3.2.4 - Missing Authorization and Cross-Site Request Forgery Checks CVSS 6.3 · 19.02.202002.11.20214.8Import any XML or CSV File to WordPress <= 3.6.2 - Authenticated Stored Cross-Site Scripting CVSS 4.8 · 02.11.202102.06.20226.1Import any XML or CSV File to WordPress <= 3.6.6 - Reflected Cross-Site Scripting CVSS 6.1 · 02.06.202228.06.20229.1WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution CVSS 9.1 · 28.06.202230.06.20227.2Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload CVSS 7.2 · 30.06.202201.07.20224.8WP All Import <= 3.6.7 - Admin+ Arbitrary File Upload CVSS 4.8 · 01.07.202217.10.20226.5Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal CVSS 6.5 · 17.10.20226.5Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload CVSS 6.5 · 17.10.202229.12.20237.2Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload CVSS 7.2 · 29.12.202310.04.20244.3Import any XML or CSV File to WordPress <= 3.7.3 - Cross-Site Request Forgery to Notice Dismissal CVSS 4.3 · 10.04.202407.04.20253.7Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel) CVSS 3.7 · 07.04.202509.09.20257.2Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload CVSS 7.2 · 09.09.202512.11.20258.8Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic CVSS 8.8 · 12.11.202505.03.20266.1WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath' CVSS 6.1 · 05.03.202626.06.20264.9WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 - Authenticated (Administrator+) SQL Injection CVSS 4.9 · 26.06.2026

Strategic Overview

Avg CVSSMedium
6.5/ 10
Patch Coverage100%
Open

0

Fixed

23

Get automatic notifications for all WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets vulnerabilities before they are exploited.

Vulnerability Records

23 records
2026-06-26 00:00CVE-2026-57628
4.9
Medium
Ananda DhakalYes
2026-03-05 00:00CVE-2026-2830
6.1
Medium
Osvaldo Noe Gonzalez Del Rio (Os)Yes
2025-11-12 00:00CVE-2025-12733
8.8
High
tmrswrrYes
2025-09-09 00:00CVE-2025-10001
7.2
High
Nguyen Truong (Roll)Yes
2025-04-07 00:00CVE-2014-2054
3.7
Low
AnonymousYes
2024-04-10 00:00CVE-2024-31939
4.3
Medium
Dhabaleshwar DasYes
2023-12-29 00:00CVE-2023-7082
7.2
High
quangntYes
2022-10-17 00:00CVE-2022-2711
6.5
Medium
lucyYes
2022-10-17 00:00CVE-2022-3418
6.5
Medium
lucyYes
2022-07-01 00:00CVE-2022-2268
4.8
Medium
moresecYes
Showing 1–10 of 23 reports
WP All Import – Drag &amp; Drop Import for CSV, XML, Excel &amp; Google Sheets banner
Latestv4.1.1

WP All Import – Drag &amp; Drop Import for CSV, XML, Excel &amp; Google Sheets

WP All Import

Author

WP All Import

4.7(1,963)
94/100
Last Updated
2026-07-16 (14d ago)
Active Installs
100,000+
Downloads
5,509,509
Requires WP
5.0+
Requires PHP
7.4+
Tested up to
WP 7.0.2
Created
2012-07-24 (14y ago)

WP All Import – Simple & Powerful XML, CSV, Google Sheets, and Excel Importer Plugin “It’s a wonderful plugin that does so much, so well that it’s hard to list all of the features. But I’ll tell you this, I was able to import the content of a pair of websites running the ModX CMS into a WordPress install in less than 30 minutes. No joke!” Alex Vasquez – DigiSavvy Co-Founder & WordCamp Los Angeles Organizer WP All Import has a four-step import process and an intuitive drag-and-drop interface that makes complicated import tasks simple and fast. There are no special requirements that the elements in your file must be laid out in a certain way. WP All Import can import any XML, CSV, Excel spreadsheet, or Google Sheets file into WordPress. WP All Import can be used for everything from migrating content from a legacy CMS to WordPress to building a store with affiliate datafeed to displaying live stock quotes or sports scores to building a real estate portal. Check out our documentation and video tutorials to make the most of WP All Import. WP All Import integrates with our companion plugin, WP All Export. You can export posts, WooCommerce products, orders, users, or anything else with WP All Export. Then you can edit the WordPress data with Microsoft Excel, Numbers, or maybe something else, and re-import to the same site or migrate the data to another site with WP All Import. For technical support from the developers, please consider purchasing WP All Import Pro. WP All Import Pro Version WP All Import Pro is a paid upgrade that includes premium support and adds the following features: Import data to Custom Fields – used by many themes, especially those using Custom Post Types – to store data associated with the posts. Import images to the post media gallery – WP All Import can download images from URLs in an XML or CSV file and put them in the media gallery. Import files from a URL – Download and import CSV, XML, or Excel WordPress data files from external websites, even if they are password-protected with HTTP authentication. Cron Job/Recurring Imports from external URLs – WP All Import Pro can periodically check a file for updates, and add, edit, and delete the imported posts accordingly. Execution of Custom PHP Functions on data, i.e., use something like [my_function({xpath/to/a/field[1]})] in your template, to pass the value of {xpath/to/a/field[1]} to my_function and display whatever it returns. Guaranteed technical support via e-mail. Upgrade to the Pro edition of WP All Import. Need to import XML and CSV to WooCommerce? Check out our WooCommerce add-on. WordPress CSV Imports Read on to learn more about the CSV importer functionality of WP All Import. Importing CSVs with WP All Import is exactly the same as importing XML files because internally, WP All Import actually converts your CSV file to an XML file on the fly. You can use the same XPath filtering options and all the same features you have when importing XML files. CSV imports, including those exported from Excel and Google Sheets, don’t require your file to have a specific structure. Your CSV file can use any column names/headings. You can map the columns in your CSV file to the appropriate places in WordPress during the import process. When importing CSV files, your CSV should have UTF-8 encoding if you are having trouble importing special characters. In step 2 of a CSV import, you can specify an alternative delimiter if you aren’t using a comma. WP All Import can import CSVs that are pipe-delimited, # delimited, or delimited/separated by any other character. For CSV import tutorials and example files, visit our documentation. Please keep in mind CSV imports with WP All Import are just like XML imports – you have all the same functionality, and the process is exactly the same. Any of our tutorial videos that apply to XML files also apply to importing CSV files, so if you see a tutorial with us importing an XML file, know that you can follow the exact same steps for a CSV import. WordPress Excel Import / Google Sheets Import Don’t want to convert your Excel or Google Sheets data to CSV? WP All Import also works as a Google Sheets and Excel importer for WordPress. Simply upload your Excel file as you would for CSV and WP All Import will automatically detect the columns in your file. For Google Sheets, use the &#8216;Download a file’ option and paste your sheet’s public URL to import data to WordPress. Add-Ons A number of premium add-ons are available to add functionality to the importer and make XML, CSV, Google Sheets, and Excel import tasks to complex plugins simple. Advanced Custom Fields Add-On – ACF XML & CSV importer WooCommerce Add-On – XML & CSV importer for all WooCommerce product types User Import Add-On – XML & CSV importer for users, including user_meta Link Cloak Add-On – Auto-create redirects for links present during an XML or CSV import Learn more about our add-ons at http://www.wpallimport.com/add-ons A developer API (action hooks) is also available. Related Plugins Export any WordPress data to XML/CSV Import Products from any XML or CSV to WooCommerce Export Products to CSV/XML for WooCommerce Custom Product Tabs for WooCommerce WP All Import Add-on Export Orders to CSV/XML for WooCommerce Export WordPress Users to CSV/XML Premium Support You can submit the support form on our website or email us at support@wpallimport.com. While we try to assist users of our free version, please note that support is not guaranteed and will depend on our capacity. For premium support, purchase WP All Import Pro. Import To WooCommerce Need to import Excel, XML and CSV to WooCommerce? Check out our WooCommerce add-on. WooCommerce Excel, XML & CSV Import Pro Version

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C