Skip to content
OpenAdvisories

Vendor

carazo

11 known vulnerabilities.

Products

Import and export users and customers 11
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-17001 Public exploit

    Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields

    The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This…

    carazo Import and export users and customers Web / CMS
  • High 8.8
    CVE-2026-86583 Public exploit

    Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields

    The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cell…

    carazo Import and export users and customers Web / CMS
  • High 8.1
    CVE-2026-3629 Public exploit

    Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields

    The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can b…

    carazo Import and export users and customers Web / CMS