WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

321 searches this plugin appeared in over the last 90 days, 20 listed. 228 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 41% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 8.4 years ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

1. ★★★★★ ixian

   4mo ago

   The product is truly awesome and support responded to my question quickly during business hours.

   Read on wp.org ↗
2. ★★★★★ chlustanec

   5mo ago

   Cant do variable products. Cant do variable products. Cant do variable products. Cant do variable products. Cant do variable products.

   Read on wp.org ↗
3. ★★★★★ pixelshouse

   6mo ago

   WP All Import is honestly one of the most powerful and intelligent plugins I’ve ever used in WordPress. It saved me a huge amount of time and effort when dealing with large datasets. What would normally take days of manual work, I was able to complete in a fraction of the time. The interface is very flexible and smart — you can map fields exactly the way you want, handle complex imports, and even automate the process. It works smoothly with WooCommerce and custom fields, which makes it perfect for real-world projects. What I really appreciate is how it simplifies complicated tasks. Even when working with large files or detailed product data, everything feels fast and under control. If you deal with bulk data, products, or migrations, WP All Import is not just helpful — it’s essential. Highly recommended.

   Read on wp.org ↗
4. ★★★★★ joezappie

   7mo ago

   I made a bug report a few months ago, they confirmed it was a bug and gave me a work around. Told me it would take more than a few days to fix so I waited around a month and reached back out to get an update. Another 3 weeks nothing so I checked in again. Nothing. Been another few weeks and I’m not going to bother trying to get a hold of them again. Unfortunately this is a bug that makes it very difficult for us to use the plugin based on our ACF structure. We really want to to buy the scheduling subscription to automate our imports monthly, but with this bug I cant justify it. This topic was modified 3 months, 3 weeks ago by joezappie.

   Read on wp.org ↗
5. ★★★★★ emdiadesign

   8mo ago

   No UX/UI, Almost none importable without premium and it doesn’t even show custom taxonomies. Just throw that plugin into the bin. This topic was modified 4 months, 1 week ago by emdiadesign.

   Read on wp.org ↗
6. ★★★★★ zhayter88

   8mo ago

   I’ve been using the pro version of this plugin for 8 years now and it’s consistently been a great experience. As with all new software there’s a learning curve, but this one was worth it. I couldn’t manage a e-commerce site with a catalogue of over 600 products without it.

   Read on wp.org ↗
7. ★★★★★ koupmi

   8mo ago

   You have zero knowledge about user interface. Zero. So i clicked on export all post from CPT. I clicked on import all post to CPT. What happened? First attempt – 228 new imported blank posts Second attempt – 228 rewrited post with blank title and blank content So i have to now fix my database from backup, because you are not able make it simple for users, click on export click on import. No instead you set default rules what gonna destroy database. Great Great job, i go now vibecode new plugin what will work 1000% better than yours!

   Read on wp.org ↗
8. ★★★★★ adw259

   9mo ago

   Wp All Import is a very well-written application with lots of granular control. I’ve used it to migrate hundreds of listings from one website to another with ease!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.1.1 security improvement: hardening of inline PHP execution restriction 4.1.1
2. — Version 4.1.0 security improvement: hardening of database queries improvement: ported new add-on API API: pmxi_fire_hooks, pmxi_disabled_delete_missing_options, pmxi_hidden_delete_missing_options, pmxi_status_of_removed_options, pmxi_ 4.1.0
3. — Version 4.0.1 security improvement: fixes CVE-2026-2830 maintenance: update packages 4.0.1
4. — Version 4.0.0 NOTE: inline PHP execution is disabled when both DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS are set in wp-config.php security improvement: fixes CVE-2025-12733 maintenance: update PhpSpreadsheet 4.0.0
5. — Version 3.9.6 fix: hierarchical taxonomy terms are not imported correctly fix: JS error in some cases with certain field names 3.9.6
6. — Version 3.9.5 improvement: upgrade svg-sanitize library 3.9.5

All 23 disclosed vulnerabilities are patched in the current version (4.1.4). Sites still on an older version should update.

1. Patched Medium · 4.9 WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 - Authenticated (Administrator+) SQL Injection ↗
   2026-06-26 CVE-2026-57628 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.0.1 Patched in 4.1.0
2. Patched Medium · 6.1 WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath' ↗
   2026-03-05 CVE-2026-2830 Improper Control of Generation of Code Affects <= 4.0.0 Patched in 4.0.1
3. Patched High · 8.8 Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic ↗
   2025-11-12 CVE-2025-12733 Improper Control of Generation of Code Affects <= 3.9.6 Patched in 4.0.0
4. Patched High · 7.2 Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload ↗
   2025-09-09 CVE-2025-10001 Unrestricted Upload of File with Dangerous Type Affects <= 3.9.3 Patched in 3.9.4
5. Patched Low · 3.7 Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel) ↗
   2025-04-07 CVE-2014-2054 Dependency on Vulnerable Third-Party Component Affects <= 3.8.0 Patched in 3.9.0
6. Patched Medium · 4.3 Import any XML or CSV File to WordPress <= 3.7.3 - Cross-Site Request Forgery to Notice Dismissal ↗
   2024-04-10 CVE-2024-31939 Cross-Site Request Forgery Affects <= 3.7.3 Patched in 3.7.4
7. Patched High · 7.2 Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload ↗
   2023-12-29 CVE-2023-7082 Unrestricted Upload of File with Dangerous Type Affects < 3.7.3 Patched in 3.7.3
8. Patched Medium · 6.5 Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal ↗
   2022-10-17 CVE-2022-2711 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.6.8 Patched in 3.6.9
9. Patched Medium · 6.5 Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload ↗
   2022-10-17 CVE-2022-3418 Unrestricted Upload of File with Dangerous Type Affects <= 3.6.8 Patched in 3.6.9
10. Patched Medium · 4.8 WP All Import <= 3.6.7 - Admin+ Arbitrary File Upload ↗
    2022-07-01 CVE-2022-2268 Improper Control of Generation of Code Affects <= 3.6.7 Patched in 3.6.8
11. Patched High · 7.2 Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload ↗
    2022-06-30 CVE-2022-1565 Unrestricted Upload of File with Dangerous Type Affects <= 3.6.7 Patched in 3.6.8
12. Patched Critical · 9.1 WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution ↗
    2022-06-28 CVE-2022-36386 Improper Control of Generation of Code Affects <= 3.6.7 Patched in 3.6.8
13. Patched Medium · 6.1 Import any XML or CSV File to WordPress <= 3.6.6 - Reflected Cross-Site Scripting ↗
    2022-06-02 Improper Neutralization of Input During Web Page Generation Affects <= 3.6.6 Patched in 3.6.7
14. Patched Medium · 4.8 Import any XML or CSV File to WordPress <= 3.6.2 - Authenticated Stored Cross-Site Scripting ↗
    2021-11-02 CVE-2021-24714 Improper Neutralization of Input During Web Page Generation Affects < 3.6.3 Patched in 3.6.3
15. Patched High · 7.2 Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection ↗
    2020-02-19 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.2.4 Patched in 3.2.5
16. Patched Medium · 6.3 Import any XML or CSV File to WordPress <= 3.2.4 - Missing Authorization and Cross-Site Request Forgery Checks ↗
    2020-02-19 Missing Authorization Affects <= 3.2.4 Patched in 3.2.5
17. Patched High · 7.5 Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks ↗
    2019-08-20 CVE-2015-9331 Missing Authorization Affects < 3.2.4 Patched in 3.2.4
18. Patched Medium · 6.1 WP All Import <= 3.4.5 - Cross-Site Scripting ↗
    2018-03-08 CVE-2018-0546 Improper Neutralization of Input During Web Page Generation Affects < 3.4.6 Patched in 3.4.6
19. Patched Medium · 6.1 WP All Import <= 3.4.6 - Cross-Site Scripting ↗
    2018-03-08 CVE-2018-0547 Improper Neutralization of Input During Web Page Generation Affects < 3.4.7 Patched in 3.4.7
20. Patched Medium · 6.1 Import any XML or CSV File to WordPress <= 3.4.6 - Cross-Site Scripting ↗
    2018-03-07 CVE-2018-20978 Improper Neutralization of Input During Web Page Generation Affects < 3.4.7 Patched in 3.4.7
21. Patched Medium · 6.1 Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting ↗
    2017-10-08 CVE-2017-18567 Improper Neutralization of Input During Web Page Generation Affects < 3.4.6 Patched in 3.4.6
22. Patched Critical · 9.8 Import any XML or CSV File to WordPress < 3.2.5 - SQL Injection ↗
    2015-03-12 CVE-2015-9330 Improper Neutralization of Special Elements used in an SQL Command Affects < 3.2.5 Patched in 3.2.5
23. Patched Medium · 6.1 Import any XML or CSV File to WordPress <= 3.2.4 - Reflected Cross-Site Scripting ↗
    2015-02-26 CVE-2015-9329 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.4 Patched in 3.2.5

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 61 languages, 4 at 90% or more

Plus 37 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2018-06-01 90K+ → 100K+ up after 91 days in tier
2. 2018-03-02 80K+ → 90K+ up after 178 days in tier
3. 2017-09-05 70K+ → 80K+ up after 66 days in tier
4. 2017-07-01 80K+ → 70K+ down after 29 days in tier
5. 2017-06-02 70K+ → 80K+ up after 66 days in tier
6. 2017-03-28 50K+ → 70K+ up after 198 days in tier
7. 2016-09-11 40K+ → 50K+ up after 280 days in tier
8. 2015-12-06 30K+ → 40K+ up after 193 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets into a readme, a review or a deck. It updates itself.

WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets: 100K+ active installs, 4.7★ (1,966 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/wp-all-import