Wp Import Export Lite (Unknown) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-19. Vendor: Unknown.
CVEs of Wp Import Export Lite
- CVE-2026-76554 - CVSS 7.2 (high), 2026-09-19: The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and…
- CVE-2026-76556 - CVSS 6.8 (medium), 2026-09-16: The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements,…
- CVE-2026-76559 - CVSS 4.1 (medium), 2026-09-16: The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with…
- CVE-2026-76555 - CVSS 6.8 (medium), 2026-09-16: The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly…
- CVE-2026-76558 - CVSS 6.8 (medium), 2026-09-16: The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of…
- CVE-2026-76557 - CVSS 6.8 (medium), 2026-09-16: The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL…
- CVE-2026-76552 - CVSS 8.8 (high), 2026-09-16: The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL…
- CVE-2026-76551 - CVSS 7.2 (high), 2026-09-16: The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted…
- CVE-2026-76550 - CVSS 7.2 (high), 2026-09-16: The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its…
- CVE-2026-76553 - CVSS 6.5 (medium), 2026-09-16: The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the…
