Unknown Wp Import Export Lite vulnerabilities

10 CVEs affecting Unknown Wp Import Export Lite, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-76554, published 2026-09-19.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-76551, published 2026-09-16. High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days. The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary…
• CVE-2026-76550, published 2026-09-16. High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days. The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with…
• CVE-2026-76552, published 2026-09-16. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its…
• CVE-2026-76555, published 2026-09-16. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose…
• CVE-2026-76554, published 2026-09-19. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a…
• CVE-2026-76553, published 2026-09-16. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to…
• CVE-2026-76558, published 2026-09-16. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens,…
• CVE-2026-76557, published 2026-09-16. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an…
• CVE-2026-76556, published 2026-09-16. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export…
• CVE-2026-76559, published 2026-09-16. Medium severity, CVSS 4.1. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which…