CVE-2026-17001: medium-severity vulnerability in carazo Import and export users and customers
Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
Published
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.4
exploitation probability
—
observed exploitation
nono source reports it
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
carazo · Import and export users and customersRelated CVEs — carazo Import and export users and customers
In the same product, most dangerous first.
CVE-2023-6583MEDIUMImport and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import FunctionalityEPSS 0.8%CVE-2026-7641HIGHImport and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta FieldsEPSS 0.7%CVE-2026-3629HIGHImport and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fieldsEPSS 0.5%CVE-2024-1050MEDIUMImport and export users and customers <= 1.26.5 - Missing AuthorizationEPSS 0.4%CVE-2026-15026MEDIUMImport and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX ActionEPSS 0.4%CVE-2023-6624MEDIUMImport and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.3%