CVE-2026-17001: fallo de gravedad media en carazo Import and export users and customers
Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
Publicada el
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.4epss 0.2%
de la publicación al arma0 días
Publicada en NVD15 oct
1ª PoC3 ago
probabilidad de explotación
0.2%top 92% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Productos afectados
carazo · Import and export users and customersPoCs públicas encontradas — 1
githubgithub.com/llaytynher/CVE-2026-17001★ 0⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — carazo Import and export users and customers
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-6583MEDIUMImport and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import FunctionalityEPSS 0.8%CVE-2026-7641HIGHImport and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta FieldsEPSS 0.7%CVE-2026-3629HIGHImport and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fieldsEPSS 0.5%CVE-2024-1050MEDIUMImport and export users and customers <= 1.26.5 - Missing AuthorizationEPSS 0.4%CVE-2026-15026MEDIUMImport and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX ActionEPSS 0.4%CVE-2023-6624MEDIUMImport and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.3%