PLUGIN SECURITY
Is Export All Urls safe?
Export post, page and custom post type data to CSV or JSON, and snapshot your site to detect added, removed or changed content.
What this plugin does
- Slug:
export-all-urls - Author: Atlas Gondal
- 50000+ active installs
- 92/100 rating (94 reviews on wordpress.org)
- 827807 all-time downloads
- On WordPress.org since 2016-04-07
csvexportJSONlinksurls
Maintenance status
- Latest known version: 6.0
- Last updated: 2026-06-25 5:27am GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 5.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
7 known CVEs on file for Export All Urls.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2023-3118 | Export All URLs [export-all-urls] < 4.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.6 | 4.6 | 2023-06-19 | ✓ fixed in latest |
| CVE-2022-27856 | Export All URLs [export-all-urls] < 4.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Low 3.4 | < 4.2 | 4.2 | 2023-05-10 | ✓ fixed in latest |
| CVE-2022-2638 | Export All URLs [export-all-urls] < 4.4 | External Control of File Name or Path | Medium 6.5 | < 4.4 | 4.4 | 2022-08-08 | ✓ fixed in latest |
| CVE-2022-29452 | Export All URLs [export-all-urls] < 4.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Low 3.4 | < 4.2 | 4.2 | 2022-05-27 | ✓ fixed in latest |
| CVE-2022-0892 | Export All URLs [export-all-urls] < 4.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.2 | 4.2 | 2022-03-21 | ✓ fixed in latest |
| CVE-2022-0914 | Export All URLs [export-all-urls] < 4.3 | Cross-Site Request Forgery (CSRF) | Medium 6.5 | < 4.3 | 4.3 | 2022-03-21 | ✓ fixed in latest |
| — | Export All URLs [export-all-urls] < 5.1 | — | Unknown | < 5.1 | 5.1 | 0000-00-00 | ✓ fixed in latest |
| CVE-2026-2696 | Export All URLs < 5.1 - Unauthenticated Sensitive Data Exposure | — | Unknown | < 5.1 | 5.1 | — | ✓ fixed in latest |
How to fix it
Keep Export All Urls updated — 6.0 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- TablePress – Tables in WordPress made easy — 600000+ active installs — 100/100 (4625) — max PHP 8.4
- WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets — 100000+ active installs — 94/100 (1962) — max PHP <8.0
- Customizer Export/Import — 100000+ active installs — 96/100 (115) — max PHP 8.4
- Advanced Order Export For WooCommerce — 100000+ active installs — 100/100 (350) — max PHP <8.0
- WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel — 100000+ active installs — 90/100 (413) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.