PLUGIN SECURITY
Is Import Users From Csv With Meta safe?
Bulk import and export WordPress users and WooCommerce customers from CSV, including roles, passwords and any custom meta.
What this plugin does
- Slug:
import-users-from-csv-with-meta - Author: Javier Carazo
- 70000+ active installs
- 94/100 rating (258 reviews on wordpress.org)
- 6785067 all-time downloads
- On WordPress.org since 2014-07-14
bulk importcsvexport usersimport usersmigrate users
Maintenance status
- Latest known version: 2.4.9
- Last updated: 2026-10-23 9:58pm GMT
- Tested up to WordPress: 7.1.3
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
32 known CVEs on file for Import Users From Csv With Meta.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-17001 | Import and export users and customers [import-users-from-csv-with-meta] < 2.4.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.4.6 | 2.4.6 | 2026-10-05 | ✓ fixed in latest |
| CVE-2026-104757 | Import and export users and customers [import-users-from-csv-with-meta] < 2.5.7 | Incorrect Privilege Assignment | High 7.2 | < 2.5.7 | 2.5.7 | 2026-09-24 | ⚠ update needed |
| CVE-2026-94178 | Import and export users and customers [import-users-from-csv-with-meta] < 2.5.4 | Incorrect Privilege Assignment | High 7.5 | < 2.5.4 | 2.5.4 | 2026-09-23 | ⚠ update needed |
| CVE-2026-92541 | Import and export users and customers [import-users-from-csv-with-meta] < 2.5.2 | Improper Privilege Management | High 7.2 | < 2.5.2 | 2.5.2 | 2026-09-18 | ⚠ update needed |
| CVE-2026-16542 | Import and export users and customers [import-users-from-csv-with-meta] < 2.4.5 | Server-Side Request Forgery (SSRF) | Medium 4.1 | < 2.4.5 | 2.4.5 | 2026-09-18 | ✓ fixed in latest |
| CVE-2026-92540 | Import and export users and customers [import-users-from-csv-with-meta] < 2.5.2 | Improper Privilege Management | High 7.2 | < 2.5.2 | 2.5.2 | 2026-09-18 | ⚠ update needed |
| CVE-2026-86583 | Import and export users and customers [import-users-from-csv-with-meta] < 2.4.18 | Incorrect Privilege Assignment | High 8.8 | < 2.4.18 | 2.4.18 | 2026-09-18 | ⚠ update needed |
| CVE-2026-16534 | Import and export users and customers [import-users-from-csv-with-meta] < 2.4.2 | Improper Privilege Management | Unknown | < 2.4.2 | 2.4.2 | 2026-08-03 | ✓ fixed in latest |
+ 32 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-15673 | Import and export users and customers [import-users-from-csv-with-meta] < 2.4.3 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Unknown | < 2.4.3 | 2.4.3 | 2026-07-24 | ✓ fixed in latest |
| CVE-2026-7641 | Import and export users and customers [import-users-from-csv-with-meta] < 2.0.9 | Improper Privilege Management | High 8.8 | < 2.0.9 | 2.0.9 | 2026-05-01 | ✓ fixed in latest |
| CVE-2026-15026 | Import and export users and customers [import-users-from-csv-with-meta] < 2.4.1 | Missing Authorization | Medium 4.3 | < 2.4.1 | 2.4.1 | 2026-05-01 | ✓ fixed in latest |
| CVE-2025-24689 | Import and export users and customers [import-users-from-csv-with-meta] < 1.27.13 | Insertion of Sensitive Information into Externally-Accessible File or Directory | Medium 5.9 | < 1.27.13 | 1.27.13 | 2025-01-27 | ✓ fixed in latest |
| CVE-2024-50413 | Import and export users and customers [import-users-from-csv-with-meta] < 1.27.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 1.27.6 | 1.27.6 | 2024-10-24 | ✓ fixed in latest |
| CVE-2024-38787 | Import and export users and customers [import-users-from-csv-with-meta] < 1.26.9 | Exposure of Sensitive Information to an Unauthorized Actor | High 7.5 | < 1.26.9 | 1.26.9 | 2024-08-07 | ✓ fixed in latest |
| CVE-2024-4734 | Import and export users and customers [import-users-from-csv-with-meta] < 1.26.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.4 | < 1.26.7 | 1.26.7 | 2024-05-14 | ✓ fixed in latest |
| CVE-2024-4656 | Import and export users and customers [import-users-from-csv-with-meta] < 1.26.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.4 | < 1.26.7 | 1.26.7 | 2024-05-14 | ✓ fixed in latest |
| CVE-2024-34815 | Import and export users and customers [import-users-from-csv-with-meta] < 1.26.6 | Missing Authorization | Medium 5.4 | < 1.26.6 | 1.26.6 | 2024-05-09 | ✓ fixed in latest |
| CVE-2024-1050 | Import and export users and customers [import-users-from-csv-with-meta] < 1.26.6 | Missing Authorization | Medium 4.3 | < 1.26.6 | 1.26.6 | 2024-05-03 | ✓ fixed in latest |
| CVE-2024-32817 | Import and export users and customers [import-users-from-csv-with-meta] < 1.26.3 | Deserialization of Untrusted Data | Medium 4.4 | < 1.26.3 | 1.26.3 | 2024-04-22 | ✓ fixed in latest |
| CVE-2024-22151 | Import and export users and customers [import-users-from-csv-with-meta] < 1.24.7 | Missing Authorization | Medium 5.3 | < 1.24.7 | 1.24.7 | 2024-01-16 | ✓ fixed in latest |
| CVE-2023-6624 | Import and export users and customers [import-users-from-csv-with-meta] < 1.24.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.24.4 | 1.24.4 | 2023-12-11 | ✓ fixed in latest |
| CVE-2023-6583 | Import and export users and customers [import-users-from-csv-with-meta] < 1.24.3 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.2 | < 1.24.3 | 1.24.3 | 2023-12-08 | ✓ fixed in latest |
| CVE-2022-3558 | Import and export users and customers [import-users-from-csv-with-meta] < 1.20.5 | Improper Neutralization of Formula Elements in a CSV File | High 8.0 | < 1.20.5 | 1.20.5 | 2022-10-17 | ✓ fixed in latest |
| CVE-2022-1255 | Import and export users and customers [import-users-from-csv-with-meta] < 1.19.2.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 1.19.2.1 | 1.19.2.1 | 2022-04-11 | ✓ fixed in latest |
| CVE-2020-22277 | Import and export users and customers [import-users-from-csv-with-meta] < 1.16.3.6 | Improper Neutralization of Formula Elements in a CSV File | High 8.0 | < 1.16.3.6 | 1.16.3.6 | 2020-11-04 | ✓ fixed in latest |
| — | Import and export users and customers [import-users-from-csv-with-meta] < 1.15.0.1 | — | Unknown | < 1.15.0.1 | 1.15.0.1 | 2020-01-06 | ✓ fixed in latest |
| — | Import and export users and customers [import-users-from-csv-with-meta] < 1.15.0.1 | — | Unknown | < 1.15.0.1 | 1.15.0.1 | 2020-01-01 | ✓ fixed in latest |
| — | Import and export users and customers [import-users-from-csv-with-meta] < 1.14.2.2 | — | Unknown | < 1.14.2.2 | 1.14.2.2 | 2019-06-26 | ✓ fixed in latest |
| CVE-2019-14683, CVE-2019-15326 | Import and export users and customers [import-users-from-csv-with-meta] < 1.14.2.2 | Cross-Site Request Forgery (CSRF) | Medium 5.7 | < 1.14.2.2 | 1.14.2.2 | 2019-06-22 | ✓ fixed in latest |
| CVE-2019-15327 | Import and export users and customers [import-users-from-csv-with-meta] < 1.14.1.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.14.1.3 | 1.14.1.3 | 2019-06-20 | ✓ fixed in latest |
| CVE-2019-15326 | Import and export users and customers [import-users-from-csv-with-meta] < 1.14.2.2 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.5 | < 1.14.2.2 | 1.14.2.2 | 2019-06-20 | ✓ fixed in latest |
| CVE-2019-15328 | Import and export users and customers [import-users-from-csv-with-meta] < 1.14.0.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.14.0.3 | 1.14.0.3 | 2019-03-14 | ✓ fixed in latest |
| CVE-2019-15329, CVE-2019-15328 | Import and export users and customers [import-users-from-csv-with-meta] < 1.14.0.3 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 1.14.0.3 | 1.14.0.3 | 2019-03-14 | ✓ fixed in latest |
| CVE-2018-20101 | Import and export users and customers [import-users-from-csv-with-meta] < 1.12.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.12.1 | 1.12.1 | 2018-12-11 | ✓ fixed in latest |
| — | Import and export users and customers [import-users-from-csv-with-meta] < 1.9.5 | — | Unknown | < 1.9.5 | 1.9.5 | 2016-09-02 | ✓ fixed in latest |
| — | Import and export users and customers [import-users-from-csv-with-meta] < 1.9.5 | — | Unknown | < 1.9.5 | 1.9.5 | 2016-09-02 | ✓ fixed in latest |
| — | Import and export users and customers [import-users-from-csv-with-meta] < 2.0 | — | Unknown | < 2.0 | 2.0 | 0000-00-00 | ✓ fixed in latest |
| — | Import and export users and customers [import-users-from-csv-with-meta] < 1.15.0.1 | — | Unknown | < 1.15.0.1 | 1.15.0.1 | — | ✓ fixed in latest |
| — | Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export | — | Unknown | < 1.15.0.1 | 1.15.0.1 | — | ✓ fixed in latest |
| CVE-2026-3629 | Import and export users and customers < 2.0 - Privilege Escalation to Administrator via save_extra_user_profile_fields | — | Unknown | < 2.0 | 2.0 | — | ✓ fixed in latest |
How to fix it
Keep Import Users From Csv With Meta updated — 2.4.9 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- TablePress – Tables in WordPress made easy — 600000+ active installs — 100/100 (4625) — max PHP 8.4
- WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets — 100000+ active installs — 94/100 (1964) — max PHP <8.0
- wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin — 60000+ active installs — 90/100 (449) — max PHP <8.0
- Export All URLs — 50000+ active installs — 92/100 (94) — max PHP 8.4
- WP Import Export Lite — 40000+ active installs — 80/100 (113)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.