The plugin processes a 'filepath' parameter from user input without proper sanitization or escaping, enabling a reflected cross‑site scripting (XSS) vulnerability. An attacker can craft a malicious URL that, when a victim clicks it, injects JavaScript into the page to steal credentials, hijack the session, or perform other client‑side attacks. The flaw does not require authentication and is triggered by a simple link click.

WordPress sites that have the WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin installed, versions 4.0.0 and earlier. The vulnerability is present in all prior releases, so any site using a legacy version is at risk.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog, meaning no publicly known exploit has yet been confirmed. Attackers would need to lure a user into clicking a crafted link, so the risk level is moderate but mitigated by user awareness and the need for the target to be a WordPress visitor.