What the vulnerability does
01Description
The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filepath’ parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
WP All Import versions up to 4.0.0 contain a code injection vulnerability that allows an attacker to inject and execute arbitrary code through the import functionality. The vulnerability requires user interaction—a site admin or authorized user must initiate an import action. An attacker can craft a malicious import file to execute code in the context of the WordPress site, potentially compromising the entire installation.
What an attacker can do
03Attacker Capabilities
Inject and execute arbitrary code on the WordPress site through a malicious import file.
Potential impact on your site
04Site Impact
An attacker can run malicious code on your site if they trick an admin into importing a crafted file, risking full site compromise.
Conditions required to exploit
05Prerequisites
An authorized user (admin or importer) must initiate an import using an attacker-controlled file.
Key dates
06Disclosure timeline
March 6, 2026
CVE published
April 8, 2026
Record updated
