The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile… (CVE-2026-17001)

CVE-2026-17001 describes a stored XSS vulnerability in the Import and export users and customers WordPress plugin, affecting all versions up to 2.4.5. The flaw is due to improper sanitization and escaping of user input in custom column user meta profile fields, allowing authenticated attackers with custom-level access or above to inject arbitrary web scripts. These scripts execute in the context of other users viewing the injected pages, potentially leading to session hijacking or other script-based attacks.

An attacker with authenticated access at custom-level or higher can inject persistent malicious scripts into user meta profile fields. These scripts execute in the browsers of users who view the injected pages, potentially leading to information disclosure or session compromise. The vulnerability does not affect availability but impacts confidentiality and integrity.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with custom-level permissions and above, and monitor for suspicious activity related to user meta profile fields.