CVE-2025-12894: Jcollings Import Wp – Export And Import Csv And XML Files To WordPress

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp.

Affected products

• Jcollings Import Wp – Export And Import Csv And XML Files To WordPress: up to and including 2.14.17

Published 2025-11-21. Last modified 2026-10-07.