CVE-2026-17001 carazo CVE debrief

Who should care

Defenders responsible for WordPress installations using the Import and export users and customers plugin, version 2.4.5 or earlier, should assess exposure and prioritize updating the plugin to a version that addresses the vulnerability.

Why it matters

The CVE-2026-17001 vulnerability in the Import and export users and customers plugin for WordPress allows authenticated attackers to inject malicious scripts, posing a risk to WordPress installations using the affected plugin versions.

• Authenticated attackers with custom-level access and above can inject arbitrary web scripts in pages.
• Injected scripts will execute whenever a user accesses an injected page.
• Defenders must verify exposure of WordPress installations using the Import and export users and customers plugin, version 2.4.5 or earlier.
• Remediation priority is high for WordPress installations using the affected plugin versions.

Technical summary

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability has a CVSS score of 6.4 and a severity of MEDIUM. Defenders should prioritize verifying exposure of WordPress installations using the Import and export users and customers plugin, version 2.4.5 or earlier, and assess the risk of authenticated attackers

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the Import and export users and customers plugin, version 2.4.5 or earlier, and assess the risk of authenticated attackers injecting malicious scripts.

Recommended defensive actions

• Verify WordPress installations using the Import and export users and customers plugin, version 2.4.5 or earlier, and assess exposure
• Assess the risk of authenticated attackers injecting malicious scripts in pages
• Prioritize updating the plugin to a version that addresses the vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. Defenders should verify exposure of WordPress installations using the Import and export users and customers plugin, version 2.4.5 or earlier, and assess

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.