CVE-2026-17001: Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
WordPress sites using the Import and export users and customers plugin version 2.4.5 or earlier are affected.
What access does an attacker need to exploit this issue?
An attacker must be authenticated to the WordPress site and have custom-level access or higher. They can inject script through Custom Column User Meta Profile Fields.
When does the injected script execute?
The malicious script is stored and executes when a user accesses a page containing the injected content.
What version should be used to remediate the issue?
Update the plugin to version 2.4.6 or later. The referenced change history identifies 2.4.6 as the version following affected version 2.4.5.