CVE-2026-2830 is a reflected cross-site scripting vulnerability in the WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets WordPress plugin, affecting all versions up to 4.0.0. The issue stems from improper input sanitization and output escaping of the 'filepath' parameter, enabling unauthenticated attackers to inject malicious scripts that execute when a user interacts with a crafted link. This vulnerability is categorized as CWE-94, indicating improper control over code generation. The CVSS 3.1 score of 6.1 reflects a medium impact with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial confidentiality and integrity impact.

Successful exploitation allows an unauthenticated attacker to perform reflected cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the victim's browser. This can result in partial disclosure or modification of information accessible to the user. There is no indication of availability impact or privilege escalation. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links involving the 'filepath' parameter in this plugin. Consider disabling or restricting access to the plugin if possible. Monitor official WP All Import channels for updates and apply patches promptly once available.