WP Import Export Lite

80 Quality Score

Active Installs

21/30

At 40,000 active installs it has a real user base, but it trails the leading import/export plugins by more than an order of magnitude, so the community and third-party documentation are thinner.

Update Freshness

25/25

Updated within the last few weeks and explicitly tested against WordPress 7.0, which signals active development and forward compatibility.

User Rating

12/15

An 80/100 score from 113 ratings is solid, though the relatively small sample size means a handful of outliers can sway the average more than with a plugin rated by thousands of users.

Support Health

8/15

Zero support threads opened and zero resolved, which is technically a 100% resolution rate but in practice means there is no public track record of help when something breaks.

WP Compatibility

15/15

The minimum bar is low at WordPress 4.4 and PHP 5.6, and it has been verified on the latest WordPress release, so it should run on virtually any modern hosting stack.

Scores higher than 79% of indexed plugins

About

Complete Import & Export solution for Posts, Pages, Custom Posts, Users, Taxonomies, Comments, and more.

Active Installs 40k+

Rating ★★★★ 4/5

Last Updated 2026-09-12 10:57am GMT

Requires WordPress 4.4+

Tested Up To 7.1

Requires PHP 5.6+

Security History

16 known vulnerabilities, all patched

7 High 9 Medium

Most recent: September 17, 2026

View details ▸

Import Export Lite <= 3.9.34 - Authenticated (Admin+) Privilege Escalation Medium

September 17, 2026 Patched in ["3.9.35"] CVE-2026-76554

Import Export Lite <= 3.9.32 - Authenticated (Administrator+) Server-Side Request Forgery Medium

September 14, 2026 Patched in ["3.9.33"] CVE-2026-76559

Import Export Lite <= 3.9.32 - Authenticated (Admin+) Remote Code Execution High

September 14, 2026 Patched in ["3.9.33"] CVE-2026-76551

Import Export Lite <= 3.9.32 - Authenticated (Admin+) SQL Injection Medium

September 14, 2026 Patched in ["3.9.33"] CVE-2026-76556

Import Export Lite <= 3.9.32 - Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion Medium

September 14, 2026 Patched in ["3.9.33"] CVE-2026-76553

Import Export Lite <= 3.9.32 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

September 14, 2026 Patched in ["3.9.33"] CVE-2026-76558

Import Export Lite <= 3.9.32 - Authenticated (Admin+) Arbitrary File Read Medium

September 14, 2026 Patched in ["3.9.33"] CVE-2026-76555

Import Export Lite <= 3.9.32 - Authenticated (Admin+) SQL Injection Medium

September 14, 2026 Patched in ["3.9.33"] CVE-2026-76557

Import Export Lite <= 3.9.32 - Authenticated (Admin+) Arbitrary File Upload High

September 14, 2026 Patched in ["3.9.33"] CVE-2026-76552

Import Export Lite <= 3.9.33 - Authenticated (Admin+) Remote Code Execution High

September 14, 2026 Patched in ["3.9.34"] CVE-2026-76550

WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter Medium

July 2, 2026 Patched in ["3.9.31"] CVE-2026-11397

WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload High

August 4, 2025 Patched in ["3.9.30"] CVE-2025-5061

WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload High

August 4, 2025 Patched in ["3.9.29"] CVE-2025-6207

WP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Medium

April 21, 2025 Patched in ["3.9.28"] CVE-2025-2839

WP Import Export Lite <= 3.9.26 - Authenticated (Administrator+) PHP Object Injection High

April 5, 2024 Patched in ["3.9.27"] CVE-2024-31308

WP Import Export Lite & WP Import Export <= 3.9.15 - Unauthenticated Sensitive Data Disclosure High

January 14, 2022 Patched in ["3.9.16"] CVE-2022-0236

What It Does

WP Import Export Lite provides a one-click interface to move posts, pages, custom post types, users, taxonomies, and comments in and out of WordPress via CSV or XML files. It includes scheduled imports and exports, so you can automate recurring data syncs rather than running them manually each time. The 'Lite' label indicates a freemium model, meaning the free build covers common data types but advanced features are reserved for a paid tier.

Who It's For

This plugin fits small to mid-sized agencies and site owners who need to migrate content, bulk-edit user accounts, or sync inventory or listings on a schedule without writing custom SQL. With 40,000 active installs and a broad set of supported post types, it works well for content-heavy sites that outgrow the native WordPress importer but do not need an enterprise ETL pipeline.

Who Should Skip It

If you only need full-site backups or staging copies, a dedicated tool like WPvivid or All-in-One WP Migration will be safer and easier to operate. You should also skip this if you rely on WooCommerce orders, advanced custom fields, or any premium-only data type, since those features sit behind the paid upgrade.

The Bottom Line

WP Import Export Lite earns an 80.11/100 quality score thanks to recent updates and broad format coverage, but the lack of public support history and modest install base mean you are betting on a smaller vendor. It is a reasonable choice for straightforward CSV migrations on single sites, and a risky one for mission-critical ecommerce or large multisite operations where the paid tier or a more established alternative would be safer.

Pick this when you need a full-site backup or migration in one click rather than surgical CSV-level data transfers.

TablePress 95/100

Pick this if your import job is really about publishing structured tables on the front end rather than managing native WordPress content.

The Events Calendar 90/100

Pick this when your data is event-based and you need calendar UI on top of the import workflow.

WPvivid Backup, Migration & Staging 89/100

Pick this if backup reliability and staging environments matter more than granular CSV-based data manipulation.

ManageWP Worker 88/100

Pick this when you manage many sites from one dashboard and want import/export rolled into a broader maintenance toolset.