WP All Import — Vulnerabilities & Security Advisories 3

WP All Import is a WordPress plugin designed for importing and managing large datasets, primarily used for content migration and bulk data operations. Historically, it has been susceptible to multiple remote code execution (RCE) vulnerabilities, often stemming from insufficient input validation and improper file handling. Cross-site scripting (XSS) and privilege escalation issues have also been documented, allowing attackers to execute unauthorized actions or compromise user sessions. The plugin's three recorded CVEs highlight persistent security risks, particularly in versions prior to 2021. While no major public incidents have been widely reported, the pattern of vulnerabilities underscores the importance of maintaining updated installations and implementing proper access controls to mitigate potential exploitation risks.