WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets Security & Risk Analysis
wordpress.org/plugins/wp-all-importEasily import any file of any size into any plugin, post type, custom field, or taxonomy. Supports WooCommerce, ACF, images, galleries, users, real es …
Is WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets Safe to Use in 2026?
Mostly Safe
Score 75/100WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets is generally safe to use. 22 past CVEs were resolved. Keep it updated.
The static analysis of wp-all-import v4.0.1 reveals a mixed security posture. While the plugin demonstrates strong adherence to modern WordPress security practices with a significant number of capability checks and a high percentage of properly escaped outputs, the presence of dangerous functions like `create_function` and `unserialize` in the code signals potential areas of concern. These functions, if not handled with extreme care and proper sanitization, can be vectors for code execution or deserialization vulnerabilities. The taint analysis showing flows with unsanitized paths is also a notable risk, though currently not classified as critical or high, it warrants attention as these could lead to unintended file access or manipulation. The plugin's history of 22 known CVEs, including critical and high severity vulnerabilities, despite having no currently unpatched CVEs, suggests a past susceptibility to a wide range of attack types such as code injection, path traversal, and SQL injection. This history, coupled with the presence of older WordPress ecosystem issues like CSRF and unrestricted uploads, indicates that while the current version might be free of known critical flaws, a history of significant vulnerabilities requires ongoing vigilance and thorough testing.
Key Concerns
- Dangerous functions (create_function, unserialize)
- Flows with unsanitized paths
- History of 2 critical CVEs
- History of 6 high CVEs
- History of 13 medium CVEs
- SQL queries not using prepared statements
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets Security Vulnerabilities
CVEs by Year
Severity Breakdown
22 total CVEs
WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'
Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic
Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload
Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel)
Import any XML or CSV File to WordPress <= 3.7.3 - Cross-Site Request Forgery to Notice Dismissal
Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload
Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal
Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload
WP All Import <= 3.6.7 - Admin+ Arbitrary File Upload
Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution
Import any XML or CSV File to WordPress <= 3.6.6 - Reflected Cross-Site Scripting
Import any XML or CSV File to WordPress <= 3.6.2 - Authenticated Stored Cross-Site Scripting
Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection
Import any XML or CSV File to WordPress <= 3.2.4 - Missing Authorization and Cross-Site Request Forgery Checks
Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks
WP All Import <= 3.4.5 - Cross-Site Scripting
WP All Import <= 3.4.6 - Cross-Site Scripting
Import any XML or CSV File to WordPress <= 3.4.6 - Cross-Site Scripting
Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting
Import any XML or CSV File to WordPress < 3.2.5 - SQL Injection
Import any XML or CSV File to WordPress <= 3.2.4 - Reflected Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets Code Analysis
Dangerous Functions Found
Bundled Libraries
SQL Query Safety
Output Escaping
Data Flow Analysis
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets Attack Surface
WordPress Hooks 32
Maintenance & Trust
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets Maintenance & Trust
Maintenance Signals
Community Trust
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets Alternatives
Import WP – Export and Import CSV and XML files to WordPress
jc-importer
Import WP, a simple, fast and powerful XML and CSV import solution, Making it easy to import posts, pages, categories, tags, users and attachments.
WP Smart Import : Import any XML File to WordPress
wp-smart-import
The most powerful solution for importing any CSV and XML files to WordPress. Create Posts and Pages any Custom Posttype with content from any XML or C …
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel
wp-all-export
Easily export data from any post type, custom field, or taxonomy to a CSV, XML, or Excel file of any custom format. Supports WooCommerce products, ord …
WP All Import – Import Add-On for ACF
csv-xml-import-for-acf
Drag & drop to import any CSV, Excel, XML, or Google Sheets file into Advanced Custom Fields. Supports repeaters, flexible content, galleries, and …
WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress
wp-ultimate-csv-importer
Effortlessly import, export, and migrate your WordPress data with WP Ultimate CSV Importer. This all-in-one solution supports CSV, XML, and Excel file …
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets Developer Profile
22 plugins · 207K total installs
How We Detect WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.