CVE-2026-80517: WP Ultimate CSV Importer XSS Vulnerability

CVE-2026-80517 Overview

CVE-2026-80517 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Ultimate CSV Importer WordPress plugin in versions prior to 9.2. The plugin fails to validate file types within uploaded archives and does not sanitize their content before storing them in a publicly accessible location. High privilege users such as administrators can leverage this flaw to inject persistent scripts. The issue is tracked under CWE-79.

Critical Impact
On WordPress Multisite installations, site Administrators lack the unfiltered_html capability. This vulnerability lets them execute scripts in the browser session of any user who views the file, including Network Super Admins.

Affected Products

WP Ultimate CSV Importer WordPress plugin versions before 9.2
WordPress Multisite installations are particularly affected
Any WordPress site allowing administrator-level archive uploads via the plugin

Discovery Timeline

2026-10-03 - CVE-2026-80517 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-80517

Vulnerability Analysis

The WP Ultimate CSV Importer plugin accepts archive uploads as part of its import workflow. The plugin extracts the archive contents and places the resulting files in a publicly served location. During this process, the plugin neither validates the extensions or MIME types of files inside the archive nor sanitizes their content.

An attacker with high privileges can craft an archive containing an HTML or JavaScript file. Once extracted and served, requesting the file renders attacker-controlled script in the victim's browser. The payload persists on the server, making this a Stored XSS condition rather than a reflected one.

Root Cause

The root cause is missing input validation and output sanitization in the archive extraction routine. The plugin trusts the contents of user-supplied archives and writes extracted files directly to a web-accessible directory. No content filtering, MIME inspection, or extension allow-listing is applied before the files become retrievable over HTTP.

Attack Vector

Exploitation requires an authenticated high privilege account and user interaction to view the stored file. On single-site WordPress installations, administrators already hold unfiltered_html and can inject scripts through other means, limiting the practical impact. On Multisite installations, site Administrators do not have unfiltered_html, so this vulnerability bypasses the capability model. A compromised or malicious site Administrator can target Network Super Admins by inducing them to visit the uploaded file URL.

No verified public exploit code is available. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-80517

Indicators of Compromise

Unexpected .html, .htm, .js, or .svg files inside the WP Ultimate CSV Importer upload directories under wp-content/uploads/
Archive uploads (.zip, .tar, .gz) submitted through the plugin interface by non-trusted administrator accounts
Outbound requests from Super Admin browsers to attacker-controlled domains shortly after accessing files in the plugin's upload path

Detection Strategies

Audit the plugin's upload directory for files whose extensions do not match the expected CSV or import formats
Review WordPress audit logs for upload_mimes filter bypasses and archive extraction events tied to the plugin
Scan served files in uploads directories for <script> tags, event handler attributes, and encoded JavaScript payloads

Monitoring Recommendations

Monitor administrator and Super Admin session activity for anomalous administrative actions following access to uploaded files
Alert on creation of executable or active-content file types inside wp-content/uploads/ subdirectories owned by the plugin
Track plugin version inventory across Multisite networks to confirm all nodes run WP Ultimate CSV Importer 9.2 or later

How to Mitigate CVE-2026-80517

Immediate Actions Required

Upgrade WP Ultimate CSV Importer to version 9.2 or later on all affected WordPress installations
Review existing files in the plugin's upload directories and remove any unexpected HTML, JavaScript, or SVG files
Audit site Administrator accounts on Multisite installations and revoke access for untrusted users

Patch Information

The vendor addressed the issue in WP Ultimate CSV Importer version 9.2. The fix validates file types contained in uploaded archives and sanitizes extracted content before writing to the public upload location. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict the plugin's import functionality to a limited set of trusted Super Admin accounts until patching is complete
Deploy a web application firewall rule to block requests for HTML, JS, or SVG files served from the plugin's upload directories
Configure the web server to serve files from the plugin's upload paths with a Content-Disposition: attachment header to prevent inline script execution

bash

# Example Apache configuration to prevent script execution in plugin upload directory
<Directory "/var/www/html/wp-content/uploads/wp_ultimate_csv_importer">
    <FilesMatch "\.(html|htm|js|svg)$">
        ForceType application/octet-stream
        Header set Content-Disposition "attachment"
    </FilesMatch>
</Directory>