CVE-2026-80517

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: WPScan

Description

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-80517

EUVD

EUVD-2026-91935

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	WP	Ultimate CSV Importer 7.17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the WP Ultimate CSV Importer WordPress plugin versions 7.17 to 9.1. It occurs because the plugin fails to properly validate file types in uploaded ZIP archives and does not sanitize their content before storing them in a publicly accessible location.

Detection Guidance

Check if the WP Ultimate CSV Importer plugin version is between 7.17 and 9.1. Inspect uploaded ZIP archives for SVG files stored in publicly accessible locations. Review server logs for unusual file uploads or script executions.

Impact Analysis

High-privilege users like administrators can exploit this to upload malicious SVG files. These files can then execute scripts in the sessions of users who view them, including Network Super Admins on Multisite installations where site administrators lack the unfiltered_html capability.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to the risk of stored cross-site scripting (XSS). Unauthorized script execution in user sessions may lead to data breaches or unauthorized access to sensitive information, which are key concerns under these regulations.

Mitigation Strategies

Update the WP Ultimate CSV Importer plugin to version 9.2 or later immediately. Remove any suspicious SVG files from publicly accessible directories. Restrict file upload permissions to trusted users only.

Hi! I’m here to help you understand CVE-2026-80517. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70