---
id: "CVE-2026-54862"
kind: "vulnerability"
aliases: ["CVE-2026-54862"]
title: "WordPress import-users-from-csv-with-meta plugin: stored XSS through imported user data"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["import-users-from-csv-with-meta", "package", "wordpress", "wp-plugin"]
not_affected_if: ["plugin-above-2.5.9", "plugin-not-installed"]
published_at: "2026-10-29T14:17:56+00:00"
first_seen_at: "2026-10-29T14:25:23+00:00"
updated_at: "2026-10-29T14:26:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54862", "first_seen_at": "2026-10-29T14:25:23+00:00"}]
---

# WordPress import-users-from-csv-with-meta plugin: stored XSS through imported user data

The Import and export users and customers WordPress plugin by Codection, versions through 2.5.9, fails to neutralize input during page generation. An attacker can store script that runs in the browser of anyone who views the affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the plugin `import-users-from-csv-with-meta` in the WordPress admin plugin list or `wp plugin get import-users-from-csv-with-meta --field=version`
- Confirm whether the plugin is active at all on the site

## Fix

- Move the plugin to a version newer than `2.5.9`, as stated by the source range; the exact fixed version is unknown

## Timeline

- 2026-10-29T14:25:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54862

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_