The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.Referenceshttps://wordpress.org/plugins/import-users-from-csv-with-meta/#developershttps://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta?rev=2050450
