4.4
Medium
CVE-2024-4734 The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin…
Description
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Import and export users and customers 1.26 | earliest → 1.26.6.1 | No fix stated |
| import_and_export_users_and_customers 1.26 | earliest → 1.26.6.1 | No fix stated |
Other CVEs of Import and export users and customers
The 11 CVEs of Import and export users and customers →
CVE-2026-120554
Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
8.8
High
CVE-2026-17001
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom…
6.4
Medium
CVE-2026-86583
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions…
8.8
High
CVE-2026-15026
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all…
4.3
Medium