Live › vulnerability › CVE-2026-54862
The Import and export users and customers WordPress plugin by Codection, versions through 2.5.9, fails to neutralize input during page generation. An attacker can store script that runs in the browser of anyone who views the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Sites running WordPress with the Import and export users and customers plugin (import-users-from-csv-with-meta) at version 2.5.9 or earlier are exposed. The stored script is delivered through pages that show the imported data, so the risk is highest where administrators or other logged-in users view those pages. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
import-users-from-csv-with-meta in the WordPress admin plugin list or wp plugin get import-users-from-csv-with-meta --field=version2.5.9, as stated by the source range; the exact fixed version is unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-54862")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.