WP All Import Pro

WP All Import Pro has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2025; all 10 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 5 high. 2020 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (30%). Other recurring categories include Missing Authorization, SQL Injection.

Every one of the 10 issues recorded for WP All Import Pro has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (4) reported by Kacper Szurek.

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP All Import Pro vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8

All Import Pro Plugin < 4.1.2 - SQL injection

Read the full analysis

Vulnerability Records

10 records


2025-02-07 03:06	WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion WP All Import Pro <= 4.9.7	`CVE-2024-9661`	4.3 Medium	Francesco Carlucci	Yes
2025-02-07 03:05	WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File WP All Import Pro <= 4.9.7	`CVE-2024-9664`	7.2 High	Francesco Carlucci	Yes
2025-01-18 15:42	WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload WP All Import Pro <= 4.9.7	`CVE-2024-8722`	5.5 Medium	Francesco Carlucci	Yes
2024-12-16 16:25	WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import WP All Import Pro <= 4.9.3	`CVE-2024-9624`	7.6 High	Ivan Kuzymchak	Yes
2020-03-19 00:00	All Import Pro Plugin < 4.1.2 - SQL injection WP All Import Pro < 4.1.2	`N/A`	8.8 High	Kacper Szurek	Yes
2020-02-19 00:00	WP All Import Pro < 4.1.1 - Reflected Cross Site Scripting WP All Import Pro < 4.1.1	`N/A`	6.1 Medium	James Golovich	Yes
2020-02-19 00:00	Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection WP All Import Pro <= 4.1.1	`N/A`	7.2 High	Kacper Szurek	Yes
2020-02-19 00:00	Import any XML or CSV File to WordPress <= 3.2.4 - Missing Authorization and Cross-Site Request Forgery Checks WP All Import Pro <= 4.1.1	`N/A`	6.3 Medium	Kacper Szurek	Yes
2019-08-20 00:00	Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks WP All Import Pro < 4.1.1	`CVE-2015-9331`	7.5 High	James Golovich	Yes
2015-02-26 00:00	Import any XML or CSV File to WordPress <= 3.2.4 - Reflected Cross-Site Scripting WP All Import Pro <= 4.1.1	`CVE-2015-9329`	6.1 Medium	Kacper Szurek	Yes

Showing 1–10 of 10 reports