Input validation vulnerability in Import any XML, CSV or Excel File to WordPress 3.9.6

A plugin called Import any XML, CSV or Excel File to WordPress (WP All Import) for WordPress has a security vulnerability in all versions up to 3.9.6. This is because it uses a function called eval() on input that has not been checked for harmful code. This means that attackers who have access to the plugin (usually administrators) can insert their own PHP code and make it run on the server. This could result in remote code execution, which is a serious issue.