Does WP All Import – Import Add-On for ACF have any unpatched vulnerabilities?

No published vulnerabilities and no findings under coordinated disclosure as of the latest data update. Always keep the plugin updated to the latest version.

Is WP All Import – Import Add-On for ACF compatible with WordPress 6.9.5?

According to WordPress.org data, WP All Import – Import Add-On for ACF 1.0.7 has been tested up to WordPress 6.9.5. Check the plugin's changelog for the latest compatibility information.

Is WP All Import – Import Add-On for ACF compatible with PHP 7.4+?

WP All Import – Import Add-On for ACF requires PHP 7.4 or higher. Most modern WordPress hosts run PHP 8.1 or 8.2. If you are on an older PHP version, consider upgrading before installing this plugin.

How often is WP All Import – Import Add-On for ACF updated?

WP All Import – Import Add-On for ACF was last updated on Jan 30, 2026. Frequent updates are generally a positive security signal.

What is WP All Import – Import Add-On for ACF's security score?

WP All Import – Import Add-On for ACF has a WP-Safety security score of 100/100. This score is computed from CVE history, patch response time, developer trust signals, and plugin maintenance activity.

WP All Import – Import Add-On for ACF Security & Risk Analysis

wordpress.org/plugins/csv-xml-import-for-acf

Drag & drop to import any CSV, Excel, XML, or Google Sheets file into Advanced Custom Fields. Supports repeaters, flexible content, galleries, and …

50K active installs v1.0.7 PHP 7.4+ WP 5.0+ Updated Jan 30, 2026

acf-importcsv-importimport-acfimport-advanced-custom-fieldsxml-import

A · Safe

CVEs total0

Unpatched0

Last CVENever

Plugin page Download

Safety Verdict

Is WP All Import – Import Add-On for ACF Safe to Use in 2026?

Generally Safe

Score 100/100

WP All Import – Import Add-On for ACF has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 6mo ago

Risk Assessment

The plugin "csv-xml-import-for-acf" v1.0.7 presents a generally good security posture based on the provided static analysis. The absence of AJAX handlers, REST API routes, shortcodes, and cron events with direct user interaction significantly limits the attack surface. Furthermore, the high percentage of SQL queries using prepared statements and proper output escaping are commendable security practices. The plugin also demonstrates awareness of security by including nonce and capability checks. The vulnerability history is also a strong positive indicator, with no recorded CVEs suggesting a history of secure development and maintenance.

Key Concerns

Dangerous function 'unserialize' used
Taint analysis shows unsanitized paths

Vulnerabilities

None known

WP All Import – Import Add-On for ACF Security Vulnerabilities

No known vulnerabilities — this is a good sign.

Version History

WP All Import – Import Add-On for ACF Release Timeline

v1.0.7Current

v1.0.6

v1.0.5

v1.0.4

v1.0.3

v1.0.2

v1.0.1

v1.0.0

Code Analysis

Analyzed Mar 16, 2026

WP All Import – Import Add-On for ACF Code Analysis

Dangerous Functions

Raw SQL Queries

22 prepared

Unescaped Output

166 escaped

Nonce Checks

Capability Checks

File Operations

External Requests

Bundled Libraries

Dangerous Functions Found

unserialize$field = (!empty($cur_meta_val[0])) ? unserialize($cur_meta_val[0]) : array();actions\pmxi_reimport.php:51

unserialize$field = (!empty($cur_meta_val[0])) ? unserialize($cur_meta_val[0]) : array();helpers\pmai_is_acf_update_allowed.php:165

unserialize$field = (!empty($cur_meta_val[0])) ? unserialize($cur_meta_val[0]) : array();helpers\pmai_is_acf_update_allowed.php:192

unserialize$result[$k] = unserialize($v);models\model\record.php:45

unserialize$field = ( ! empty( $cur_meta_val[0] ) ) ? unserialize( $cur_meta_val[0] ) : array();plugin.php:474

unserialize$field_post_options = unserialize($field_post->post_content);src\fields\acf\FieldCountry.php:56

unserialize$fieldData = empty($subFieldData->post_content) ? array() : unserialize($subFieldData->post_content)src\fields\Field.php:743

unserialize$this->fieldsData[] = empty($cur_meta_val[0]) ? array() : unserialize($cur_meta_val[0]);src\groups\GroupV4.php:22

SQL Query Safety

92% prepared24 total queries

Output Escaping

96% escaped173 total outputs

Data Flows · Security

2 unsanitized

Data Flow Analysis

2 flows2 with unsanitized paths

force_ssl (controllers\controller.php:39)

Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized

Attack Surface

WP All Import – Import Add-On for ACF Attack Surface

Entry Points0

Unprotected0

WordPress Hooks 4

filteruser_has_capmodels\import\record.php:33

actionadmin_initplugin.php:239

actioninitplugin.php:240

filtercurrent_screenplugin.php:351

Maintenance & Trust

WP All Import – Import Add-On for ACF Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.5

Last updatedJan 30, 2026

PHP min version7.4

Downloads270K

Community Trust

Rating100/100

Number of ratings6

Active installs50K

Alternatives

WP All Import – Import Add-On for ACF Alternatives

WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

wp-all-import

Easily import any file of any size into any plugin, post type, custom field, or taxonomy. Supports WooCommerce, ACF, images, galleries, users, real es …

100K 23 CVEs

WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel

wp-ultimate-csv-importer

The #1 WordPress import export plugin. Bulk import CSV, XML & Excel into WordPress — WooCommerce products, posts, users, ACF fields, and more. Free.

20K 27 CVEs

Import WooCommerce Suite for Products, Orders, Coupons, Reviews, and Customers | WP Ultimate CSV Importer

import-woocommerce

100

Import WooCommerce products, orders, coupons, customers, and reviews from CSV, XML, or Excel files. An add-on for WP Ultimate CSV Importer.

4K 1 CVE

Import WP – Export and Import CSV and XML files to WordPress

jc-importer

Import WP, a simple, fast and powerful XML and CSV import solution, Making it easy to import posts, pages, categories, tags, users and attachments.

4K 5 CVEs

Automotive Inventory Importer – Sync Car Dealer Feeds

automotive-feed-import

100

Sync car dealer inventory from any XML/CSV feed into WordPress. Field mapping, search & gallery. Multilingual; works with any theme or DMS.

10 No CVEs

Developer Profile

WP All Import – Import Add-On for ACF Developer Profile

WP All Import

22 plugins · 217K total installs

trust score

Avg Security Score

99/100

Avg Patch Time

993 days

View full developer profile

Detection Fingerprints

How We Detect WP All Import – Import Add-On for ACF

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths

/wp-content/plugins/csv-xml-import-for-acf/assets/css/main.css/wp-content/plugins/csv-xml-import-for-acf/assets/js/main.js/wp-content/plugins/csv-xml-import-for-acf/assets/css/admin-style.css/wp-content/plugins/csv-xml-import-for-acf/assets/js/admin-script.js/wp-content/plugins/csv-xml-import-for-acf/assets/js/vendor/jquery/jquery.js/wp-content/plugins/csv-xml-import-for-acf/assets/js/vendor/jquery/jquery-migrate.min.js

Script Paths

/wp-content/plugins/csv-xml-import-for-acf/assets/js/main.js/wp-content/plugins/csv-xml-import-for-acf/assets/js/admin-script.js/wp-content/plugins/csv-xml-import-for-acf/assets/js/vendor/jquery/jquery.js/wp-content/plugins/csv-xml-import-for-acf/assets/js/vendor/jquery/jquery-migrate.min.js

Version Parameters

csv-xml-import-for-acf/assets/css/main.css?ver=csv-xml-import-for-acf/assets/js/main.js?ver=csv-xml-import-for-acf/assets/css/admin-style.css?ver=csv-xml-import-for-acf/assets/js/admin-script.js?ver=

HTML / DOM Fingerprints

CSS Classes

pmai-import-formpmai-field-mappingpmai-upload-sectionpmai-custom-field-selector

Data Attributes

data-field-typedata-acf-field-namedata-acf-field-group

JS Globals

PMAI_ROOT_URLPMAI_VERSIONPMAI_PREFIX

Shortcode Output

[pmxi_import_form][pmxi_field_mapping]

FAQ