CVE-2026-80517 — WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload

Description (CNA)

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Ultimate CSV Importer	affected 7.17 before 9.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/2ac66402-2a79-42dd-9056-12c819112f07/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.