IA
Product
Import and export users and customers
10
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 4Medium 6Low 0
Watch
Add Import and export users and customers to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-86583 | 8.8 | Sep 23 | Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields Affected: through 2.4.17 |
| CVE-2026-7641 | 8.8 | May 2 | Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields Affected: through 2.0.8 |
| CVE-2026-3629 | 8.1 | Mar 21 | Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields Affected: through 1.29.7 |
| CVE-2023-6583 | 7.2 | Jan 11 | Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality Affected: through 1.24.2 |
| CVE-2026-17001 | 6.4 | Oct 15 | Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields Affected: through 2.4.5 |
| CVE-2023-6624 | 5.4 | Jan 11 | Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Affected: through 1.24.3 |
| CVE-2024-4656 | 4.4 | May 15 | Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting Affected: through 1.26.6.1 |
| CVE-2024-4734 | 4.4 | May 15 | Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting Affected: through 1.26.6.1 |
| CVE-2026-15026 | 4.3 | Jul 10 | Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action Affected: through 2.4.0 |
| CVE-2024-1050 | 4.3 | May 4 | Import and export users and customers <= 1.26.5 - Missing Authorization Affected: through 1.26.5 |
Showing 10
