WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import

80 Quality Score

Active Installs

19/30

With 20,000 active installs it is solidly mid-tier, not a household name like the top import plugins but well known within WooCommerce circles.

Update Freshness

25/25

The June 2026 update timestamp and tested compatibility with WordPress 7.0 indicate the developer is actively shipping against the latest core releases.

User Rating

13/15

An 88 out of 100 from 581 reviewers is a strong result and suggests most users get the job done without major complaints.

Support Health

8/15

Five of six threads resolved is a decent 83.3 percent closure rate, though the low absolute thread count makes it hard to judge response speed under heavier load.

WP Compatibility

15/15

Requiring PHP 7.4 and WordPress 5.0 while being tested up to 7.0 gives it a broad compatibility window for modern hosts.

Scores higher than 79% of indexed plugins

About

Import CSV, XML and Excel files into WordPress. Bulk import posts, pages, WooCommerce products, users, ACF fields, images, custom post types and more.

Active Installs 20k+

Rating ★★★★ 4.4/5

Last Updated 2026-08-17 10:27am GMT

Requires WordPress 5.0+

Tested Up To 7.0.4

Requires PHP 7.4+

Security History

28 known vulnerabilities, all patched

16 High 12 Medium

Most recent: August 29, 2026

View details ▸

WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import < 9.0 - Authenticated (Administrator+) SQL Injection Medium

August 29, 2026 Patched in ["9.0"] CVE-2026-80488

WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter High

July 10, 2026 Patched in ["8.1"] CVE-2026-13353

WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name Medium

February 17, 2026 Patched in ["7.38"] CVE-2026-1317

WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass Medium

January 1, 2026 Patched in ["7.36"] CVE-2025-14627

WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import High

November 18, 2025 Patched in ["7.34"] CVE-2025-13145

WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure Medium

November 11, 2025 Patched in ["7.33.1"] CVE-2025-12732

WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection High

September 16, 2025 Patched in ["7.29"] CVE-2025-10057

WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion High

September 16, 2025 Patched in ["7.28"] CVE-2025-10058

WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure High

September 9, 2025 Patched in ["7.28"] CVE-2025-10040

Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload High

March 31, 2025 Patched in ["7.19.1","7.20.1"] CVE-2025-2008

Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion High

March 25, 2025 Patched in ["7.19.1","7.20.1"] CVE-2025-2007

WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation Medium

August 3, 2023 Patched in ["7.9.9"] CVE-2023-4140

WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing High

August 3, 2023 Patched in ["7.9.9"] CVE-2023-4139

WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution High

August 3, 2023 Patched in ["7.9.9"] CVE-2023-4141

WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution High

August 3, 2023 Patched in ["7.9.9"] CVE-2023-4142

WP Ultimate CSV Importer <= 6.5.7 - Authenticated (Administrator+) SQL Injection High

September 20, 2022 Patched in ["6.5.8"] CVE-2022-3243

WP Ultimate CSV Importer <= 6.5.7 - Missing Authorization Medium

September 20, 2022 Patched in ["6.5.8"] CVE-2022-3244

WP Ultimate CSV Importer <= 6.5.2 - Server-Side Request Forgery Medium

June 2, 2022 Patched in ["6.5.3"] CVE-2022-1977

WP Ultimate CSV Importer <= 6.4.2 - Admin+ Stored Cross-Site Scripting Medium

January 26, 2022 Patched in ["6.4.3"] CVE-2022-0360

Import all XML, CSV & TXT into WordPress < 6.4.2 - Missing Authorization High

January 17, 2022 Patched in ["6.4.2"]

Easy Drag And drop All Import : WP Ultimate CSV Importer < 6.4.1 - Missing Authorization Checks Medium

January 12, 2022 Patched in ["6.4.1"]

WP Ultimate CSV Importer <= 6.4.0 - Arbitrary File Upload High

January 12, 2022 Patched in ["6.4.1"]

Easy Drag And drop All Import : WP Ultimate CSV Importer <= 5.6 - Cross-Site Request Forgery High

August 13, 2019 Patched in ["5.6.1"] CVE-2018-20967

Import Export All WordPress Images, Users & Post Types <= 3.8.7 - Reflected Cross-Site Scripting Medium

January 27, 2018 Patched in ["3.8.8"]

Easy Drag And drop All Import : WP Ultimate CSV Importer < 3.8.1 - Cross-Site Scripting Medium

August 18, 2015 Patched in ["3.8.1"] CVE-2015-9306

Import CSV or XML Datafeed With Ease <= 3.7.2 - Cross-Site Request Forgery Medium

May 5, 2015 Patched in ["3.7.3"] CVE-2015-10125

WP Ultimate CSV Importer <= 3.7 - Arbitrary File Read High

April 27, 2015 Patched in ["3.7.1"]

Ultimate CSV Importer < 3.6.75 - Information Disclosure High

February 22, 2015 Patched in ["3.6.75"]

What It Does

WP Ultimate CSV Importer is a bulk data migration tool that imports and exports content into WordPress from CSV, XML, and Excel files. It handles posts, pages, users, WooCommerce products, and ACF custom fields in large batches. The free version covers the core import/export workflow, which is the main reason most people install it.

Who It's For

This plugin is built for store owners and content managers who need to move large product catalogs, user lists, or editorial content into WordPress without manual entry. It is especially useful for WooCommerce shops migrating from another platform, agencies handling bulk client data, and anyone whose source data already lives in a spreadsheet.

Who Should Skip It

If you only need to move a handful of posts or users, or if your hosting environment still runs PHP below 7.4, this plugin is overkill or simply will not run. Sites looking for a lightweight, single-purpose user export tool would be better served by the more focused alternative below.

The Bottom Line

WP Ultimate CSV Importer earns its #1 billing in the description for a reason: it covers more import formats and content types than most free competitors and is clearly maintained. The overall quality score of 79.96 reflects solid ratings and upkeep tempered by a modest install base and a thinner public support footprint. It is a safe, capable choice for bulk WooCommerce and content migrations, provided your host meets the PHP 7.4 minimum.

Pick this instead if your task is narrowly scoped to user and customer data, where its 60,000 installs and higher overall score reflect deeper specialization.

LearnPress – Backup & Migration Tool 73/100

Pick this instead if you run a LearnPress LMS and want a tool purpose built for course content rather than a general importer.