Import and export users and customers

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

929 searches this plugin appeared in over the last 90 days, 20 listed. 809 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 7 months ago and the previous band took 3.2 years to cross, so the real count is still just under 80K.

1. ★★★★★ kentsmythe

   5mo ago

   The plugin did exactly what I needed. Support was quick and friendly. Solved my one issue immediately.

   Read on wp.org ↗
2. ★★★★★ pendle666

   5mo ago

   I was having an issue with some settings for users, and all I wanted was a list of all my users and what each setting was. Although it gave me loads of columns, I found what I was looking for and was able to do my changes without having to look at each individual user.

   Read on wp.org ↗
3. ★★★★★ felixsh

   6mo ago

   This plugin is very useful and works well for our user import workflow.The developer was very helpful, responsive, and open to feedback. It is great to see that the plugin is actively maintained and improved. Looking forward to using it in the future. Thanks Javier! 🙂

   Read on wp.org ↗
4. ★★★★★ wpnovice2

   1.1y ago

   I’ve used this for years, importing classlists and updating classlists each term with my courses. Lots of detailed options, I haven’t tried them all, but the ones I have used have all worked well, especially related to user roles and custom fields.

   Read on wp.org ↗
5. ★★★★★ Arischvaran Puvanesvaran

   1.4y ago

   Used this on a client site, since WP All Import Export free version is actually not “free” at all. It even managed to import the custom roles that I created using the Members plugin. Thanks for the great work!

   Read on wp.org ↗
6. ★★★★★ Paolo Beccari

   1.4y ago

   I had to transfer 900+ users of an old website (not WP), furthermore the target project is full of custom fields, extra user roles and further data. After exporting some test users on a CSV file I checked and edited all the field names in order to match my new WP website structure.The final import of all 900+ users was quick and precise.Everything smooth like oil. Anything you can imagine to export on a CSV file can be easily imported into WP, you just need to be very precise and careful with the names of the columns you need to import.Just remember: username and email columns MUST be the first ones in any import file!

   Read on wp.org ↗
7. ★★★★★ natashaconnectedmarketing

   1.5y ago

   This plugin did exactly what I needed in 5 minutes and didn’t crash my site like some other plugins. I highly recommend.

   Read on wp.org ↗
8. ★★★★★ Henry Douglas

   1.5y ago

   Great plugin.

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-11-01 Version 2.5.13 Fixed the recurring import running the first batch again and again without end when the data of the previous batch was not available in the next one, which also made the cron log grow until the settings page could not be 2.5.13
2. 2026-10-30 Version 2.5.12 Security: saving the cron task settings now checks every permission before storing anything, so a request that is rejected can no longer leave part of its settings saved Security: when the cron task was configured by a u 2.5.12
3. 2026-10-29 Version 2.5.11 When some rows are skipped because they have no email, the import result now says how many and that the Allow No Email addon can import them Uploading an XLSX, XLS or ODS file now explains that the File Formats addon can 2.5.11
4. 2026-10-29 Version 2.5.10 Security fix (path traversal and file deletion): the batch importer trusted the file path sent back by the browser on every step, so a user allowed to import users could point it to a CSV outside the uploads folder and r 2.5.10
5. 2026-10-23 Version 2.5.9 Security fix (privilege escalation): a subscriber could store profile values ending with a NUL byte so that, when a user with import and export permissions exported the users and imported the generated CSV again, the clo 2.5.9
6. — Version 2.4.4 Security fix: the BuddyPress/BuddyBoss bp_avatar CSV import now also rejects link-local ( 169.254.0.0/16 ), carrier-grade NAT ( 100.64.0.0/10 , 198.18.0.0/15 ) and other private IP ranges after resolving the URL’s host, 2.4.4

All 33 disclosed vulnerabilities are patched in the current version (2.5.13). Sites still on an older version should update.

1. Patched Medium · 6.4 Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields ↗
   2026-10-14 CVE-2026-17001 Improper Neutralization of Input During Web Page Generation Affects <= 2.4.5 Patched in 2.4.6
2. Patched Medium · 4.7 Import and export users and customers <= 2.5.5 - Authenticated (Editor+) Privilege Escalation ↗
   2026-10-05 CVE-2026-104757 Improper Privilege Management Affects <= 2.5.5 Patched in 2.5.7
3. Patched Medium · 6.3 Import and export users and customers <= 2.5.2 - Authenticated (Subscriber+) Privilege Escalation ↗
   2026-09-24 CVE-2026-94178 Improper Privilege Management Affects <= 2.5.2 Patched in 2.5.4
4. Patched High · 8.8 Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields ↗
   2026-09-23 CVE-2026-86583 Incorrect Privilege Assignment Affects <= 2.4.17 Patched in 2.4.18
5. Patched High · 7.2 Import and export users and customers <= 2.5.1 - Authenticated (Admin+) Privilege Escalation ↗
   2026-09-18 CVE-2026-92540 Improper Privilege Management Affects <= 2.5.1 Patched in 2.5.2
6. Patched High · 7.2 Import and export users and customers <= 2.5.1 - Authenticated (Admin+) Privilege Escalation ↗
   2026-09-18 CVE-2026-92541 Improper Privilege Management Affects <= 2.5.1 Patched in 2.5.2
7. Patched Medium · 5.5 Import and export users and customers <= 2.4.4 - Authenticated (Administrator+) Server-Side Request Forgery ↗
   2026-09-18 CVE-2026-16542 Server-Side Request Forgery Affects <= 2.4.4 Patched in 2.4.5
8. Patched Medium · 4.9 Import and export users and customers < 2.4.3 - Authenticated (Admin+) Arbitrary File Read ↗
   2026-07-24 CVE-2025-15673 Improper Limitation of a Pathname to a Restricted Directory Affects < 2.4.3 Patched in 2.4.3
9. Patched High · 7.2 Import and export users and customers <= 2.4.1 - Authenticated (Admin+) Privilege Escalation ↗
   2026-07-23 CVE-2026-16534 Improper Privilege Management Affects <= 2.4.1 Patched in 2.4.2
10. Patched Medium · 4.3 Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action ↗
    2026-07-09 CVE-2026-15026 Missing Authorization Affects <= 2.4.0 Patched in 2.4.1
11. Patched High · 8.8 Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields ↗
    2026-05-01 CVE-2026-7641 Improper Privilege Management Affects <= 2.0.8 Patched in 2.0.9
12. Patched High · 8.1 Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields ↗
    2026-03-21 CVE-2026-3629 Improper Privilege Management Affects <= 1.29.7 Patched in 2.0
13. Patched Medium · 5.3 Import and export users and customers <= 1.27.12 - Unauthenticated Sensitive Information Disclosure ↗
    2025-01-27 CVE-2025-24689 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.27.12 Patched in 1.27.13
14. Patched Medium · 4.4 Import and export users and customers <= 1.27.5 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-10-24 CVE-2024-50413 Improper Neutralization of Input During Web Page Generation Affects <= 1.27.5 Patched in 1.27.6
15. Patched Medium · 5.3 Import and export users and customers <= 1.26.8 - Unauthenticated Information Exposure ↗
    2024-08-07 CVE-2024-38787 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.26.8 Patched in 1.26.9
16. Patched Medium · 4.4 Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-05-14 CVE-2024-4734 Improper Neutralization of Input During Web Page Generation Affects <= 1.26.6.1 Patched in 1.26.7
17. Patched Medium · 4.4 Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-05-14 CVE-2024-4656 Improper Neutralization of Input During Web Page Generation Affects <= 1.26.6.1 Patched in 1.26.7
18. Patched Medium · 4.3 Import and export users and customers <= 1.26.5 - Missing Authorization ↗
    2024-05-09 CVE-2024-34815 Missing Authorization Affects <= 1.26.5 Patched in 1.26.6
19. Patched Medium · 4.3 Import and export users and customers <= 1.26.5 - Missing Authorization ↗
    2024-05-03 CVE-2024-1050 Missing Authorization Affects <= 1.26.5 Patched in 1.26.6
20. Patched High · 7.2 Import and export users and customers <= 1.26.2 - Authenticated (Admin+) PHP Object Injection ↗
    2024-04-22 CVE-2024-32817 Deserialization of Untrusted Data Affects <= 1.26.2 Patched in 1.26.3
21. Patched Medium · 5.3 Import and export users and customers <= 1.24.6 - Missing Authorization via fire_cron REST endpoint ↗
    2024-01-16 CVE-2024-22151 Missing Authorization Affects <= 1.24.6 Patched in 1.24.7
22. Patched Medium · 4.9 Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode ↗
    2023-12-11 CVE-2023-6624 Improper Neutralization of Input During Web Page Generation Affects <= 1.24.3 Patched in 1.24.4
23. Patched Medium · 6.6 Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality ↗
    2023-12-08 CVE-2023-6583 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 1.24.2 Patched in 1.24.3
24. Patched High · 8.0 Import and export users and customers <= 1.20.4 - Authenticated (Subscriber+) CSV Injection ↗
    2022-10-17 CVE-2022-3558 Improper Neutralization of Formula Elements in a CSV File Affects <= 1.20.4 Patched in 1.20.5
25. Patched Medium · 5.5 Import and export users and customers <= 1.19.2 - Stored Cross-Site Scripting ↗
    2022-04-11 CVE-2022-1255 Improper Neutralization of Input During Web Page Generation Affects < 1.19.2.1 Patched in 1.19.2.1
26. Patched High · 7.3 Import and export users and customers <= 1.16.3.5 - CSV injection via a customer's profile ↗
    2020-11-20 CVE-2020-22277 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects <= 1.16.3.5 Patched in 1.16.3.6
27. Patched High · 7.7 Import and export users and customers 1.15 - Sensitive Data Exposure ↗
    2020-01-01 Improper Privilege Management Affects 1.15 Patched in 1.15.0.1
28. Patched Medium · 6.3 Import and export users and customers <= 1.14.1.3 - Cross-Site Request Forgery leading to attachment deletion & Path Traversal ↗
    2019-06-22 CVE-2019-14683 Cross-Site Request Forgery Affects <= 1.14.1.3 Patched in 1.14.2.2
29. Patched High · 7.5 Import and export users and customers <= 1.14.2.1 - Directory Traversal ↗
    2019-06-20 CVE-2019-15326 Improper Limitation of a Pathname to a Restricted Directory Affects <= 1.14.2.1 Patched in 1.14.2.2
30. Patched Medium · 6.1 Import and export users and customers <= 1.14.1.2 - Cross-Site Scripting ↗
    2019-06-20 CVE-2019-15327 Improper Neutralization of Input During Web Page Generation Affects <= 1.14.1.2 Patched in 1.14.1.3
31. Patched Medium · 6.1 Import and export users and customers <= 1.14.0.2 - Cross-Site Scripting ↗
    2019-03-14 CVE-2019-15328 Improper Neutralization of Input During Web Page Generation Affects < 1.14.0.3 Patched in 1.14.0.3
32. Patched High · 8.8 Import and export users and customers <= 1.14.0.2 - Cross-Site Request Forgery ↗
    2019-03-14 CVE-2019-15329 Cross-Site Request Forgery Affects < 1.14.0.3 Patched in 1.14.0.3
33. Patched Medium · 6.1 Import users from CSV with meta <= 1.12 - Import Cross-Site Scripting ↗
    2018-12-11 CVE-2018-20101 Improper Neutralization of Input During Web Page Generation Affects < 1.12.1 Patched in 1.12.1

Translated into 14 languages, 1 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-04-15 80K+ → 70K+ down after 1156 days in tier
2. 2023-02-14 70K+ → 80K+ up after 432 days in tier
3. 2021-12-09 60K+ → 70K+ up after 237 days in tier
4. 2021-04-16 50K+ → 60K+ up after 171 days in tier
5. 2020-10-27 40K+ → 50K+ up after 178 days in tier
6. 2020-05-02 30K+ → 40K+ up after 686 days in tier
7. 2018-06-16 20K+ → 30K+ up after 445 days in tier
8. 2017-03-28 10K+ → 20K+ up after 340 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Import and export users and customers into a readme, a review or a deck. It updates itself.

Import and export users and customers: 70K+ active installs, 4.7★ (259 reviews). Plugin Pulse (WP Mayor), as of 2026-11-03. https://plugins.wpmayor.com/plugin/import-users-from-csv-with-meta