CVE-2026-17001: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in carazo Import and export users and customers

CVE-2026-17001 is a stored cross-site scripting vulnerability (CWE-79) in the carazo Import and export users and customers WordPress plugin. The vulnerability exists in all versions up to and including 2.4.5 due to improper neutralization of input during web page generation, specifically in the Custom Column User Meta Profile Fields. Authenticated attackers with custom-level privileges or above can inject arbitrary web scripts that execute in the context of other users viewing the injected pages.

Successful exploitation allows an authenticated user with custom-level access or higher to inject malicious scripts that execute in the browsers of users who view the affected pages. This can lead to information disclosure and limited integrity impact within the affected WordPress environment. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict custom-level user access to trusted individuals only and consider disabling or limiting use of the Custom Column User Meta Profile Fields feature to reduce risk.