Plugin security history

WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 23 vulnerability records associated with WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets, published between 2015 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

23Total records

2Critical

6High

13Medium

1Low

1Informational

23Patched records

0Currently marked unpatched

2015-02-26First disclosure

2026-06-26Latest disclosure

20 of 23CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	2	2 records
2017	1	1 records
2018	3	3 records
2019	1	1 records
2020	2	2 records
2021	1	1 records
2022	6	6 records
2023	1	1 records
2024	1	1 records
2025	3	3 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
Critical	2	8.7%
High	6	26.1%
Medium	13	56.5%
Low	1	4.3%
Informational	1	4.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

8 records34.8%

First: 2015. Latest: 2026.

Arbitrary File Upload

5 records21.7%

First: 2022. Latest: 2025.

SQL Injection

3 records13%

First: 2015. Latest: 2026.

Other

3 records13%

First: 2022. Latest: 2025.

Missing Authorization

2 records8.7%

First: 2019. Latest: 2020.

Path Traversal

1 record4.3%

First: 2022. Latest: 2022.

CSRF

1 record4.3%

First: 2024. Latest: 2024.

Patch Status

Patched: 23
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.1.0
4.0.1
4.0.0
3.9.4
3.9.0
3.7.4
3.7.3
3.6.9
3.6.8
3.6.7
3.6.3
3.2.4
3.4.6
3.4.7
3.2.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.0.1`	WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 - Authenticated (Administrator+) SQL Injection	June 26, 2026	4.1.0	Medium
`*-4.0.0`	WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'	March 5, 2026	4.0.1	Medium
`*-3.9.6`	Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic	November 12, 2025	4.0.0	High
`*-3.9.3`	Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload	September 9, 2025	3.9.4	High
`*-3.8.0`	Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel)	April 7, 2025	3.9.0	Low
`*-3.7.3`	Import any XML or CSV File to WordPress <= 3.7.3 - Cross-Site Request Forgery to Notice Dismissal	April 10, 2024	3.7.4	Medium
`[*, 3.7.3)`	Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload	December 29, 2023	3.7.3	High
`*-3.6.8`	Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload	October 17, 2022	3.6.9	Medium
`*-3.6.8`	Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal	October 17, 2022	3.6.9	Medium
`*-3.6.7`	WP All Import <= 3.6.7 - Admin+ Arbitrary File Upload	July 1, 2022	3.6.8	Medium
`*-3.6.7`	Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload	June 30, 2022	3.6.8	High
`*-3.6.7`	WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution	June 28, 2022	3.6.8	Critical
`*-3.6.6`	Import any XML or CSV File to WordPress <= 3.6.6 - Reflected Cross-Site Scripting	June 2, 2022	3.6.7	Medium
`[*, 3.6.3)`	Import any XML or CSV File to WordPress <= 3.6.2 - Authenticated Stored Cross-Site Scripting	November 2, 2021	3.6.3	Medium
`*-3.2.4`	Import any XML or CSV File to WordPress <= 3.2.4 - Missing Authorization and Cross-Site Request Forgery Checks	February 19, 2020	3.2.5	Medium
`*-3.2.4`	Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection	February 19, 2020	3.2.5	High
`[*, 3.2.4)`	Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks	August 20, 2019	3.2.4	High
`[*, 3.4.7)`	WP All Import <= 3.4.6 - Cross-Site Scripting	March 8, 2018	3.4.7	Medium
`[*, 3.4.6)`	WP All Import <= 3.4.5 - Cross-Site Scripting	March 8, 2018	3.4.6	Medium
`[*, 3.4.7)`	Import any XML or CSV File to WordPress <= 3.4.6 - Cross-Site Scripting	March 7, 2018	3.4.7	Medium
`[*, 3.4.6)`	Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting	October 8, 2017	3.4.6	Medium
`[*, 3.2.5)`	Import any XML or CSV File to WordPress < 3.2.5 - SQL Injection	March 12, 2015	3.2.5	Critical
`*-3.2.4`	Import any XML or CSV File to WordPress <= 3.2.4 - Reflected Cross-Site Scripting	February 26, 2015	3.2.5	Medium

Selected source records

Latest Records

MediumCVE-2026-57628

WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 - Authenticated (Administrator+) SQL Injection

Published: June 26, 2026

Affected versions: *-4.0.1
Patched versions: 4.1.0

Original Wordfence record

MediumCVE-2026-2830

WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'

Published: March 5, 2026

Affected versions: *-4.0.0
Patched versions: 4.0.1

Original Wordfence record

HighCVE-2025-12733

Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic

Published: November 12, 2025

Affected versions: *-3.9.6
Patched versions: 4.0.0

Original Wordfence record

HighCVE-2025-10001

Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload

Published: September 9, 2025

Affected versions: *-3.9.3
Patched versions: 3.9.4

Original Wordfence record

LowCVE-2014-2054

Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel)

Published: April 7, 2025

Affected versions: *-2.0.8
Patched versions: 2.0.9

Affected versions: *-3.8.0
Patched versions: 3.9.0

Original Wordfence record

InformationalCVE-2024-31939

Import any XML or CSV File to WordPress <= 3.7.3 - Cross-Site Request Forgery to Notice Dismissal

Published: April 10, 2024

Affected versions: *-3.7.3
Patched versions: 3.7.4

Original Wordfence record

HighCVE-2023-7082

Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload

Published: December 29, 2023

Affected versions: [*, 3.7.3)
Patched versions: 3.7.3

Original Wordfence record

MediumCVE-2022-2711

Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal

Published: October 17, 2022

Affected versions: *-3.6.8
Patched versions: 3.6.9

Original Wordfence record

Highest-Severity Records

CriticalCVE-2015-9330

Import any XML or CSV File to WordPress < 3.2.5 - SQL Injection

Published: March 12, 2015

Affected versions: [*, 3.2.5)
Patched versions: 3.2.5

Original Wordfence record

CriticalCVE-2022-36386

WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution

Published: June 28, 2022

Affected versions: *-3.6.7
Patched versions: 3.6.8

Original Wordfence record

HighCVE-2025-12733

Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic

Published: November 12, 2025

Affected versions: *-3.9.6
Patched versions: 4.0.0

Original Wordfence record

HighCVE-2015-9331

Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks

Published: August 20, 2019

Affected versions: [*, 4.1.1)
Patched versions: 4.1.1

Affected versions: [*, 3.2.4)
Patched versions: 3.2.4

Original Wordfence record

HighCVE-2023-7082

Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload

Published: December 29, 2023

Affected versions: [*, 3.7.3)
Patched versions: 3.7.3

Original Wordfence record

High

Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection

Published: February 19, 2020

Affected versions: *-4.1.1
Patched versions: 4.1.2

Affected versions: *-3.2.4
Patched versions: 3.2.5

Original Wordfence record

HighCVE-2022-1565

Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload

Published: June 30, 2022

Affected versions: *-3.6.7
Patched versions: 3.6.8

Original Wordfence record

HighCVE-2025-10001

Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload

Published: September 9, 2025

Affected versions: *-3.9.3
Patched versions: 3.9.4

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory