Skip to contentCarazo Import And Export Users And Customers vulnerabilities
- carazo import and export users and customersImport and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings SaveCVE-2026-1205548.8 High
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-548626.5 Medium
- carazo import and export users and customersImport and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile FieldsCVE-2026-17001Public exploit6.4 Medium
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerabilityCVE-2026-1047577.2 High
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerabilityCVE-2026-941787.5 High
- carazo import and export users and customersImport and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile F…CVE-2026-86583Public exploit8.8 High
- carazo import and export users and customersImport and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend ImporterCVE-2026-925417.2 High
- carazo import and export users and customersImport and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_usersCVE-2026-925407.2 High
- carazo import and export users and customersImport and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatarCVE-2026-165424.1 Medium
- carazo import and export users and customersImport and export users and customers < 2.4.3 - Admin+ Arbitrary File ReadCVE-2025-156734.9 Medium
- carazo import and export users and customersImport and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV ImportCVE-2026-165349.1 Critical
- carazo import and export users and customersImport and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX ActionCVE-2026-150264.3 Medium
- carazo import and export users and customersImport and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta FieldsCVE-2026-76418.8 High
- carazo import and export users and customersImport and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fieldsCVE-2026-3629Public exploit8.1 High
- carazo import and export users and customersWordPress Import and export users and customers plugin 1.27.12 - Sensitive Data Exposure vulnerabilityCVE-2025-246895.9 Medium
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-504135.9 Medium
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 1.26.8 - Sensitive Information via Imported File vulnerabilityCVE-2024-387877.5 High
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 1.26.5 - Broken Access Control vulnerabilityCVE-2024-348155.4 Medium
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 1.24.6 - Broken Access Control vulnerabilityCVE-2024-221515.3 Medium
- carazo import and export users and customersImport and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingCVE-2024-46564.4 Medium
- carazo import and export users and customersImport and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingCVE-2024-47344.4 Medium
- carazo import and export users and customersImport and export users and customers <= 1.26.5 - Missing AuthorizationCVE-2024-10504.3 Medium
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 1.26.2 - PHP Object Injection vulnerabilityCVE-2024-328174.4 Medium
- carazo import and export users and customersImport and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import FunctionalityCVE-2023-65836.6 Medium
- carazo import and export users and customersImport and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodeCVE-2023-66244.9 Medium
- carazo import and export users and customersImport and export users and customers < 1.20.5 - Subscriber+ CSV InjectionCVE-2022-35588.0 High
- carazo import and export users and customersImport and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site ScriptingCVE-2022-12554.8 Medium