Skip to content
PluginCanary

WP Ultimate CSV Importer

WP Ultimate CSV Importer - WordPress CSV, XML & Excel Import Export
by Smackcoders Inc., · 20,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 3 Nov 2026, 52 releases in 24 months, no unpatched vulnerabilities.

83/ 100 Canary Score
Sub-scores for WP Ultimate CSV Importer
Ownership100
Maintenance100
Security60
Support70
Reputation85

How the score works

Quick answers

Is WP Ultimate CSV Importer still maintained?
Yes. Last release 3 Nov 2026, 52 releases in the last 24 months. 3 Nov 2026 · wordpress.org
Who owns WP Ultimate CSV Importer, and has it changed hands?
No change recorded. Main committer smackcoders since Oct 2012. 3 Nov 2026 · SVN log
Was WP Ultimate CSV Importer removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WP Ultimate CSV Importer safe?
32 known vulnerabilities, all fixed (latest in 9.3). Not on the exploited list. 7 Oct 2026 · Wordfence Intelligence
Is the latest WP Ultimate CSV Importer update safe to install?
No ownership change before 9.3.1. No one-star spike after it. 3 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
smackcoders22 Oct 2012 to 3 Nov 2026, 514 commits

1 committer recorded. No ownership change since 2012.

Maintenance

Last release
yesterday
Releases, 24 months
52
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for WP Ultimate CSV Importer
Q1 202411
Q2 20248
Q3 20246
Q4 20249
Q1 20258
Q2 20257
Q3 20258
Q4 20257
Q1 20266
Q2 20265
Q3 20263
Q4 20262

Last release 3 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (8 reviews). Lifetime: 4.4.

Average rating per quarter for WP Ultimate CSV Importer
Q4 20255.0
Q1 20264.7
Q2 20265.0
Q3 20265.0
Q4 20265.0

Average rating stayed at 5.0 between Q4 2025 and Q4 2026.

Rating distribution
5 star478
4 star23
3 star12
2 star9
1 star71

Security record

15 vulnerabilities in 24 months (32 on record), all patched (latest fixed in 9.3).

Show 32 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
7 Oct 2026WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.2 - Authenticated (Administrator+) SQL Injection4.9<= 9.29.36
1 Oct 2026WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.1 - Unauthenticated Information Exposure5.3<= 9.19.2Patched before disclosure
1 Oct 2026Ultimate CSV Importer 7.17 - 9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting4.47.17 to 9.19.2Patched before disclosure
1 Oct 2026Ultimate CSV Importer <= 9.1 - Unauthenticated Information Exposure5.3<= 9.19.2Patched before disclosure
29 Aug 2026WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import < 9.0 - Authenticated (Administrator+) SQL Injection4.9< 9.09.0Patched before disclosure
10 Jul 2026WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter8.8<= 8.0.18.1Patched before disclosure
17 Feb 2026WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name6.5<= 7.377.38Patched before disclosure
1 Jan 2026WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass6.4<= 7.357.36Patched before disclosure
18 Nov 2025WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import7.2<= 7.33.17.34Patched before disclosure
11 Nov 2025WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure4.3<= 7.337.33.1Patched before disclosure
16 Sep 2025WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection8.87.20 to 7.287.29Patched before disclosure
16 Sep 2025WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion8.1<= 7.277.28Patched before disclosure
9 Sep 2025WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure7.7<= 7.277.28Patched before disclosure
31 Mar 2025Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload8.8<= 7.19, 7.207.19.1Patched before disclosure
25 Mar 2025Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion8.1<= 7.19, 7.207.19.1Patched before disclosure
3 Aug 2023WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution8<= 7.9.87.9.9Patched before disclosure
3 Aug 2023WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution8<= 7.9.87.9.9Patched before disclosure
3 Aug 2023WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation6.6<= 7.9.87.9.9Patched before disclosure
3 Aug 2023WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing7.5<= 7.9.87.9.9Patched before disclosure
20 Sep 2022WP Ultimate CSV Importer <= 6.5.7 - Missing Authorization5.4<= 6.5.76.5.8Patched before disclosure
20 Sep 2022WP Ultimate CSV Importer <= 6.5.7 - Authenticated (Administrator+) SQL Injection7.2<= 6.5.76.5.8Patched before disclosure
2 Jun 2022WP Ultimate CSV Importer <= 6.5.2 - Server-Side Request Forgery4.1<= 6.5.26.5.3Patched before disclosure
26 Jan 2022WP Ultimate CSV Importer <= 6.4.2 - Admin+ Stored Cross-Site Scripting4.8< 6.4.36.4.3Patched before disclosure
17 Jan 2022Import all XML, CSV & TXT into WordPress < 6.4.2 - Missing Authorization7.1<= 6.4.16.4.2Patched before disclosure
12 Jan 2022Easy Drag And drop All Import : WP Ultimate CSV Importer < 6.4.1 - Missing Authorization Checks6.3< 6.4.16.4.1Patched before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

50% of 2 support threads resolved in the last 2 months.

Momentum

20,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP Ultimate CSV Importer
4 May 20261,285
11 May 20269,765
18 May 20264,376
25 May 20268,917
1 Jun 20263,744
8 Jun 20262,723
15 Jun 20269,173
22 Jun 20263,350
29 Jun 20269,705
6 Jul 20264,027
13 Jul 20263,197
20 Jul 20262,377
27 Jul 20262,090
3 Aug 20261,924
10 Aug 20269,836
17 Aug 202611,357
24 Aug 20262,824
31 Aug 20263,405
7 Sep 20262,065
14 Sep 20262,036
21 Sep 20262,053
28 Sep 202610,317
5 Oct 20264,365
12 Oct 202611,158
19 Oct 20264,084
26 Oct 20263,696
2 Nov 2026415

Weekly downloads over the last 4 weeks are 3% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

WP All ExportScore 92 · 100,000+Widget Importer & ExporterScore 91 · 200,000+WP All ImportScore 91 · 50,000+Export media with selected content (byScore 91 · 40,000+WP All ImportScore 91 · 20,000+

Facts

Version9.3.1
AuthorSmackcoders Inc.,
Added22 Oct 2012
Last updated3 Nov 2026
Active installs20,000+
Requires WordPress5.0
Tested up to7.1.4
Requires PHP7.4
CategorySite Administration & Utilities > Site Migration & Cloning
TagsXML Import, csv importer, import-export, wordpress importer, woocommerce product import

Other plugins by this author: Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export, Import Users & Customers with Meta | WP Ultimate CSV Importer Add-on, Import WooCommerce Suite for Products, Orders, Coupons, Reviews, and Customers | WP Ultimate CSV Importer, Lead Form Data Collection to CRM, Google SEO Pressor for Rich snippets, Zoho Integration for WordPress, Vtiger CRM Integration for WordPress, W2S - WooCommerce to Shopify Sync, Follow Up Emails, Salesforce Integration for WordPress, Freshsales Integration for WordPress, AIO Performance Profiler, Monitor, Optimize, Compress & Debug

Questions

Is WP Ultimate CSV Importer still maintained?

Yes. Last release 3 Nov 2026, 52 releases in the last 24 months.

Who owns WP Ultimate CSV Importer, and has it changed hands?

No change recorded. Main committer smackcoders since Oct 2012.

Was WP Ultimate CSV Importer removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WP Ultimate CSV Importer safe?

32 known vulnerabilities, all fixed (latest in 9.3). Not on the exploited list.

Is the latest WP Ultimate CSV Importer update safe to install?

No ownership change before 9.3.1. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue