https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-6207.htmlhttps://patchthecve.com/cve/CVE-2025-6207.htmlWed, 17 Jun 2026 10:01:23 +0000HIGH 7.5: The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above, https://patchthecve.com/cve/CVE-2025-5061.htmlhttps://patchthecve.com/cve/CVE-2025-5061.htmlWed, 17 Jun 2026 09:47:07 +0000HIGH 7.5: The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and abovehttps://patchthecve.com/cve/CVE-2025-2839.htmlhttps://patchthecve.com/cve/CVE-2025-2839.htmlWed, 17 Jun 2026 09:07:42 +0000MEDIUM 6.4: The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributorhttps://patchthecve.com/cve/CVE-2024-31308.htmlhttps://patchthecve.com/cve/CVE-2024-31308.htmlWed, 17 Jun 2026 07:28:09 +0000MEDIUM 4.4: Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.