{"id":"CVE-2026-54862","kind":"vulnerability","aliases":["CVE-2026-54862"],"related":[],"title":"WordPress import-users-from-csv-with-meta plugin: stored XSS through imported user data","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9.","summary":"The Import and export users and customers WordPress plugin by Codection, versions through 2.5.9, fails to neutralize input during page generation. An attacker can store script that runs in the browser of anyone who views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["import-users-from-csv-with-meta","package","wordpress","wp-plugin"],"not_affected_if":["plugin-above-2.5.9","plugin-not-installed"],"how_to_check":"- Check the installed version of the plugin `import-users-from-csv-with-meta` in the WordPress admin plugin list or `wp plugin get import-users-from-csv-with-meta --field=version`\n- Confirm whether the plugin is active at all on the site","fix":"- Move the plugin to a version newer than `2.5.9`, as stated by the source range; the exact fixed version is unknown","status":"open","published_at":"2026-10-29T14:17:56+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:00+00:00","updated_at":"2026-10-29T14:26:00+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T14:26:00Z","model":"claude-haiku-5-5","output":{"fix":"- Move the plugin to a version newer than `2.5.9`, as stated by the source range; the exact fixed version is unknown","reach":"unknown","title":"WordPress import-users-from-csv-with-meta plugin: stored XSS through imported user data","impact":"medium","summary":"The Import and export users and customers WordPress plugin by Codection, versions through 2.5.9, fails to neutralize input during page generation. An attacker can store script that runs in the browser of anyone who views the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","import-users-from-csv-with-meta"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in victims' browsers on the site","analyst_note":"","how_to_check":"- Check the installed version of the plugin `import-users-from-csv-with-meta` in the WordPress admin plugin list or `wp plugin get import-users-from-csv-with-meta --field=version`\n- Confirm whether the plugin is active at all on the site","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-above-2.5.9"],"who_is_affected":"Sites running WordPress with the Import and export users and customers plugin (import-users-from-csv-with-meta) at version 2.5.9 or earlier are exposed. The stored script is delivered through pages that show the imported data, so the risk is highest where administrators or other logged-in users view those pages. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4125,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-54862':18A,21A '2.5.9':47B,114C 'affect':70B,104C 'allow':100C 'anyon':66B 'attack':56B 'browser':64B 'codect':44B,86C 'cross':81C 'cross-sit':80C 'csv':6A,26B,97C 'custom':40B,92C,110C 'cve':16A,19A 'data':15A 'export':37B,89C,107C 'fail':48B 'generat':54B,79C 'import':3A,13A,23B,35B,87C,94C,105C 'import-users-from-csv-with-meta':2A,22B,93C 'improp':72C 'input':51B,75C 'issu':103C 'meta':8A,28B,99C 'n/a':112C 'neutral':50B,73C 'packag':29B 'page':53B,71B,78C 'plugin':9A,33B,42B 'run':61B 'script':59B,83C 'site':82C 'store':10A,58B,101C 'user':4A,14A,24B,38B,90C,95C,108C 'version':45B 'view':68B 'vulner':84C 'web':77C 'wordpress':1A,30B,41B 'wp':32B 'wp-plugin':31B 'xss':11A 'xss.this':102C","nicknames":[],"mitigations":[],"who_affected":"Sites running WordPress with the Import and export users and customers plugin (import-users-from-csv-with-meta) at version 2.5.9 or earlier are exposed. The stored script is delivered through pages that show the imported data, so the risk is highest where administrators or other logged-in users view those pages. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54862","severity":null,"published_at":"2026-10-29T14:17:56+00:00","modified_at":"2026-10-29T14:17:56+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}