---
id: CVE-2026-80517
title: >-
  The WP Ultimate CSV Importer  WordPress plugin before 9.2 does not properly
  validate the file types contained in an uploaded archive nor sanitise their
  content before storing them in a publicly served location, allowing high
  privilege us…
summary: >-
  The WP Ultimate CSV Importer  WordPress plugin before 9.2 does not properly
  validate the file types contained in an uploaded archive nor sanitise their
  content before storing them in a publicly served location, allowing high
  privilege us…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-79
product: WP Ultimate CSV Importer
affected:
  - wp_ultimate_csv_importer >= 7.17 < 9.2
published: '2026-10-03'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T15:18:12.170'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80517'
references:
  - url: 'https://wpscan.com/vulnerability/2ac66402-2a79-42dd-9056-12c819112f07/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00142
epssPercentile: 0.03525
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-03T15:06:13.562460Z'
ingestedAt: '2026-10-03T06:39:57.562Z'
---

## Overview

The WP Ultimate CSV Importer  WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.