blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-80517

LOW 3.5 CVSS 3.1
Published
October 3, 2026
Last modified
October 6, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Description

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.

Affected WordPress components

  • WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Plugin · wp-ultimate-csv-importer
    Confirmed match Active
    From 7.17 (including) to 9.2 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown WP Ultimate CSV Importer — From 7.17 (including) to 9.2 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/2ac66402-2a79-42dd-9056-12c819112f07/
  • nvd.nist.gov Official NVD record