CVE-2026-80517: WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfilteredhtml capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Ultimate CSV Importerto a version that resolves this vulnerability.Fixed in 9.2
Event History
Frequently Asked Questions
Which deployments are most exposed to privilege escalation through this issue?
WordPress Multisite deployments are particularly exposed because a site Administrator lacks the unfiltered_html capability. That administrator can upload a crafted archive and potentially execute script in the browser session of a user who views the stored file, including a Network Super Admin.
What access does an attacker need to exploit this vulnerability?
The attacker needs high-privilege WordPress access, such as an administrator account, and must be able to upload an archive through the plugin's import functionality. Exploitation involves placing an SVG or other insufficiently validated file inside the uploaded archive.
Are installations running version 9.2 affected?
The issue affects versions before 9.2. Version 9.2 is not identified as affected by the provided information.