Unknown Wp Ultimate Csv Importer vulnerabilities

3 CVEs affecting Unknown Wp Ultimate Csv Importer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-80518, published 2026-10-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-80488, published 2026-08-29. Medium severity, CVSS 4.1. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such…
CVE-2026-80518, published 2026-10-03. Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days. The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it…
CVE-2026-80517, published 2026-10-03. Low severity, CVSS 3.5. EPSS: 0.1% chance of exploitation in the next 30 days. The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly…