WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

84 Quality Score

Active Installs

23/30

100,000 active installs is solid but lower than table-focused alternatives like TablePress, which suggests WP All Import serves a narrower, more technical audience that genuinely needs heavy imports.

Update Freshness

25/25

The plugin was updated in June 2026 and tested against WordPress 7.0, so maintenance is clearly active and current.

User Rating

14/15

A 94 out of 100 average across 1,960 ratings is strong and indicates broad user satisfaction.

Support Health

8/15

Only 2 support threads with a 50% resolution rate is a weak signal that the free support channel is thinly staffed or slow to respond.

WP Compatibility

15/15

Tested up to WordPress 7.0 and requiring PHP 7.4 keeps the plugin compatible with current and near-future WordPress environments.

Scores higher than 93% of indexed plugins

About

Easily import any file of any size into any plugin, post type, custom field, or taxonomy. Supports WooCommerce, ACF, images, galleries, users, real es …

Active Installs 100k+

Rating ★★★★½ 4.7/5

Last Updated 2026-07-16 2:00am GMT

Requires WordPress 5.0+

Tested Up To 7.0.4

Requires PHP 7.4+

Security History

22 known vulnerabilities, all patched

2 Critical 6 High 13 Medium 1 Low

Most recent: June 26, 2026

View details ▸

WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 - Authenticated (Administrator+) SQL Injection Medium

June 26, 2026 Patched in ["4.1.0"] CVE-2026-57628

WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath' Medium

March 5, 2026 Patched in ["4.0.1"] CVE-2026-2830

Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic High

November 12, 2025 Patched in ["4.0.0"] CVE-2025-12733

Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload High

September 9, 2025 Patched in ["3.9.4"] CVE-2025-10001

Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel) Low

April 7, 2025 Patched in ["3.9.0"] CVE-2014-2054

Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload High

December 29, 2023 Patched in ["3.7.3"] CVE-2023-7082

Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal Medium

October 17, 2022 Patched in ["3.6.9"] CVE-2022-2711

Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload Medium

October 17, 2022 Patched in ["3.6.9"] CVE-2022-3418

WP All Import <= 3.6.7 - Admin+ Arbitrary File Upload Medium

July 1, 2022 Patched in ["3.6.8"] CVE-2022-2268

Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload High

June 30, 2022 Patched in ["3.6.8"] CVE-2022-1565

WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution Critical

June 28, 2022 Patched in ["3.6.8"] CVE-2022-36386

Import any XML or CSV File to WordPress <= 3.6.6 - Reflected Cross-Site Scripting Medium

June 2, 2022 Patched in ["3.6.7"]

Import any XML or CSV File to WordPress <= 3.6.2 - Authenticated Stored Cross-Site Scripting Medium

November 2, 2021 Patched in ["3.6.3"] CVE-2021-24714

Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection High

February 19, 2020 Patched in ["3.2.5"]

Import any XML or CSV File to WordPress <= 3.2.4 - Missing Authorization and Cross-Site Request Forgery Checks Medium

February 19, 2020 Patched in ["3.2.5"]

Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks High

August 20, 2019 Patched in ["3.2.4"] CVE-2015-9331

WP All Import <= 3.4.5 - Cross-Site Scripting Medium

March 8, 2018 Patched in ["3.4.6"] CVE-2018-0546

WP All Import <= 3.4.6 - Cross-Site Scripting Medium

March 8, 2018 Patched in ["3.4.7"] CVE-2018-0547

Import any XML or CSV File to WordPress <= 3.4.6 - Cross-Site Scripting Medium

March 7, 2018 Patched in ["3.4.7"] CVE-2018-20978

Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting Medium

October 8, 2017 Patched in ["3.4.6"] CVE-2017-18567

Import any XML or CSV File to WordPress < 3.2.5 - SQL Injection Critical

March 12, 2015 Patched in ["3.2.5"] CVE-2015-9330

Import any XML or CSV File to WordPress <= 3.2.4 - Reflected Cross-Site Scripting Medium

February 26, 2015 Patched in ["3.2.5"] CVE-2015-9329

What It Does

WP All Import lets you bring data into WordPress from CSV, XML, Excel, or Google Sheets files using a drag-and-drop interface. It can populate any post type, custom field, taxonomy, or third-party plugin, with specific support for WooCommerce products, ACF fields, images, galleries, users, and real estate listings. The tool handles large imports and recurring scheduled feeds, making it suited for sites that depend on regular data syncing from external sources.

Who It's For

This plugin is built for site owners and developers who need to import large or recurring datasets into WordPress, especially WooCommerce stores, real estate sites, job boards, multi-vendor marketplaces, and affiliate feed operators. It is also a fit for agencies or developers building custom workflows that need to map external data fields into ACF fields, custom post types, or taxonomies without writing custom import code. Non-technical users can manage imports through the UI, but the real power is in scheduled, automated feeds.

Who Should Skip It

If your data already lives inside WordPress and you only need to display it as a table, you do not need this plugin; TablePress will do the job in a fraction of the setup time. Likewise, sites importing a small one-time list of users may find a simpler tool like Import and export users and customers easier to live with.

The Bottom Line

WP All Import earns an 83.99 quality score and is one of the most capable general-purpose import tools in the WordPress ecosystem, with proven performance on large and recurring feeds. The thin free support thread count is a real concern, so plan on relying on paid support or documentation for complex setups. If your workflow genuinely depends on importing external data into WordPress content structures, this plugin is a strong choice; if not, lighter alternatives will save you configuration time.

Pick TablePress if you mainly need to display existing WordPress data in sortable, presentable tables rather than import external files.

Import and export users and customers 83/100

Pick this alternative if your only import need is a one-off or occasional CSV load of users and customer meta without broader post or product imports.

XML Sitemap & Google News 83/100

Pick this only for generating XML sitemaps; it does not handle general data imports despite the naming overlap with WP All Import.

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin 83/100

Pick wpDataTables when your priority is presenting imported or external data visually with charts and filters rather than storing it as WordPress content.

Export All URLs 82/100

Pick Export All URLs only if you specifically need a quick URL list export; it does not perform the general-purpose imports WP All Import handles.