CVE-2026-80488 — WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields
The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow hig…
Published: 2026-08-29 · CVSS: 4.1 · CVSS 3.1
The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7