CVE-2026-54862: WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Import and export users and customersto a version that resolves this vulnerability.Fixed in 2.5.10
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs low-level authenticated privileges and must induce a user to interact with malicious content. The vulnerable functionality is reachable over the network.
What is the potential impact if exploitation succeeds?
Successful exploitation can result in stored cross-site scripting. The provided CVSS vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.
Which plugin versions are affected?
The issue affects Import and export users and customers versions through 2.5.9. The supplied data does not identify a fixed version.