WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel Security & Risk Analysis

The plugin 'wp-all-export' v1.4.15 exhibits a mixed security posture. While it demonstrates strong adherence to good practices such as implementing nonce checks, capability checks, and utilizing prepared statements for a majority of its SQL queries, there are significant areas of concern. The presence of the `unserialize` function, even if not directly exploitable in this version's static analysis, remains a historical risk factor. Taint analysis revealed flows with unsanitized paths, indicating potential for data manipulation or unauthorized access, although no critical or high-severity issues were found in this specific analysis.

The plugin's vulnerability history is a major red flag. With a total of 7 known CVEs, including a past critical vulnerability and multiple high-severity ones, the plugin has a track record of security flaws. The common vulnerability types point to systemic issues such as code injection, SQL injection, and cross-site scripting, suggesting potential weaknesses in input validation and output sanitization that may not be fully mitigated in this version. The most recent vulnerability being in 2026 indicates a potential for ongoing, undiscovered vulnerabilities.

In conclusion, while 'wp-all-export' v1.4.15 shows improvements in certain security areas, its historical vulnerability record and the presence of potentially dangerous functions and unsanitized paths necessitate a cautious approach. Users should be aware of the past security incidents and the inherent risks associated with plugins that have a history of significant vulnerabilities.