# carazo Import and export users and customers.

Every CVE that names carazo Import and export users and customers among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save](https://agentprime.io/advisories/CVE-2026-120554.md)
  `CVE-2026-120554` · CVE record: carazo Import and export users and customers · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields](https://agentprime.io/advisories/CVE-2026-17001.md)
  `CVE-2026-17001` · CVE record: carazo Import and export users and customers · CVSS 6.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile…](https://agentprime.io/advisories/CVE-2026-86583.md)
  `CVE-2026-86583` · CVE record: carazo Import and export users and customers · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Privilege escalation
- [Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action](https://agentprime.io/advisories/CVE-2026-15026.md)
  `CVE-2026-15026` · CVE record: carazo Import and export users and customers · CVSS 4.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Broken access control
- [Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields](https://agentprime.io/advisories/CVE-2026-7641.md)
  `CVE-2026-7641` · CVE record: carazo Import and export users and customers · CVSS 8.8 High · Not analysed yet · Published 2 May 2026 · Tags: Privilege escalation
- [Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields](https://agentprime.io/advisories/CVE-2026-3629.md)
  `CVE-2026-3629` · CVE record: carazo Import and export users and customers · CVSS 8.1 High · Not analysed yet · Published 21 Mar 2026 · Tags: Privilege escalation
- [Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-4656.md)
  `CVE-2024-4656` · CVE record: carazo Import and export users and customers · CVSS 4.4 Medium · Not analysed yet · Published 15 May 2024 · Tags: Cross-site scripting (XSS)
- [Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-4734.md)
  `CVE-2024-4734` · CVE record: carazo Import and export users and customers · CVSS 4.4 Medium · Not analysed yet · Published 15 May 2024 · Tags: Cross-site scripting (XSS)
- [Import and export users and customers <= 1.26.5 - Missing Authorization](https://agentprime.io/advisories/CVE-2024-1050.md)
  `CVE-2024-1050` · CVE record: carazo Import and export users and customers · CVSS 4.3 Medium · Not analysed yet · Published 4 May 2024 · Tags: Broken access control
- [Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality](https://agentprime.io/advisories/CVE-2023-6583.md)
  `CVE-2023-6583` · CVE record: carazo Import and export users and customers · CVSS 6.6 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: File inclusion
- [Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode](https://agentprime.io/advisories/CVE-2023-6624.md)
  `CVE-2023-6624` · CVE record: carazo Import and export users and customers · CVSS 4.9 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=carazo-import-and-export-users-and-customers>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/carazo-import-and-export-users-and-customers/>. Everything for agents: <https://agentprime.io/llms.txt>.