CVE-2026-80517: CWE-79 Cross-Site Scripting (XSS) in WP Ultimate CSV Importer
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.
AI Analysis
Technical Summary
The WP Ultimate CSV Importer WordPress plugin before version 9.2 does not correctly validate the file types within uploaded archives nor sanitize their content before saving them to publicly accessible locations. This flaw enables users with high privileges, such as administrators, to perform stored cross-site scripting (CWE-79) attacks. Specifically, on Multisite setups where site administrators do not have the unfiltered_html capability, this vulnerability allows them to execute scripts in the sessions of other users who view the uploaded files, including Network Super Admins.
Potential Impact
An attacker with high privileges (administrator or site administrator on Multisite) can inject malicious scripts that execute in the browsers of users who access the uploaded files. This can lead to session hijacking or other malicious actions performed in the context of privileged users, including Network Super Admins on Multisite installations.
Mitigation Recommendations
A fixed version is available starting from version 9.2. Users should upgrade WP Ultimate CSV Importer to version 9.2 or later to remediate this vulnerability. Until then, restrict upload permissions to trusted users only and avoid uploading untrusted archives.
CVE-2026-80517: CWE-79 Cross-Site Scripting (XSS) in WP Ultimate CSV Importer
Description
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.
CVSS v3.1
Score 3.5low
Affected software
WP Ultimate CSV Importer
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP Ultimate CSV Importer WordPress plugin before version 9.2 does not correctly validate the file types within uploaded archives nor sanitize their content before saving them to publicly accessible locations. This flaw enables users with high privileges, such as administrators, to perform stored cross-site scripting (CWE-79) attacks. Specifically, on Multisite setups where site administrators do not have the unfiltered_html capability, this vulnerability allows them to execute scripts in the sessions of other users who view the uploaded files, including Network Super Admins.
Potential Impact
An attacker with high privileges (administrator or site administrator on Multisite) can inject malicious scripts that execute in the browsers of users who access the uploaded files. This can lead to session hijacking or other malicious actions performed in the context of privileged users, including Network Super Admins on Multisite installations.
Mitigation Recommendations
A fixed version is available starting from version 9.2. Users should upgrade WP Ultimate CSV Importer to version 9.2 or later to remediate this vulnerability. Until then, restrict upload permissions to trusted users only and avoid uploading untrusted archives.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-26T14:31:03.074Z
- State
- PUBLISHED
Threat ID: 6ac11723a43b0b3b89cacf65
Added to database: 10/03/2026, 14:54:27 UTC
Last enriched: 10/03/2026, 14:56:16 UTC
Last updated: 10/04/2026, 05:45:56 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.