{"id":"CVE-2026-80517","published":"2026-10-03T06:16:42.693","lastModified":"2026-10-06T15:18:12.170","description":"The WP Ultimate CSV Importer  WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.","cvssScore":3.5,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/2ac66402-2a79-42dd-9056-12c819112f07/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}