Theme settings migration processes uploaded configuration data and can replace values that control a live site appearance. Customizer Export/Import version 0.9.8 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65716. The review focused on Customizer permissions, export output, uploaded settings validation, theme compatibility, option import, and optional image handling.

Name of	Customizer Export/Import
Version	0.9.8
Active installations	100,000+
Description	Exports and imports settings from the WordPress Customizer, including theme modifications and supported options, with an optional image import workflow.
Security	Successfully tested for: SQL Injection (SQLi) Cross-Site Scripting (XSS) – Stored and Reflected Cross-Site Request Forgery (CSRF) Authentication Vulnerabilities Authentication Bypass Exploits Privilege Escalation Buffer Overflow Denial-of-Service (DoS) vectors Data Leakage Vulnerabilities Insecure Dependency Usage Remote Code Execution (RCE) Risks Unauthorized File Access Insufficient Injection Protection Information Disclosure via Misconfigured Endpoints
CleanTalk Certification	Awarded PSC-2026-65716 through the CleanTalk Plugin Security Certification program for version 0.9.8.
Additional Information	Import files only from a trusted source and keep a backup of the current configuration. Confirm the active theme and review image downloads before applying a settings package.
Plugin Security Certification by CleanTalk
Logo of the plugin

Make security review part of your plugin development process and give WordPress site owners a clear certification reference.

Get Plugin Security Certificate

PSC by Cleantalk

Key Features

Customizer Export/Import adds migration controls directly to the WordPress Customizer. It exports theme modifications and supported settings stored as options, then imports them for the matching theme or child theme. An import can also download the images referenced by the settings when that option is selected. The documented workflow uses the active theme and does not support themes that are only being previewed.

Security Assurance

The review considered authorization for export and import actions, verification of submitted requests, and the handling of uploaded settings files. Theme identity, accepted option values, export responses, and optional image processing were included in the certification scope. Configuration migration was evaluated as an administrative action that can change site appearance.

The plugin has been successfully tested for:

✅ Information Leakage Vulnerabilities

✅ SQL Injection Vulnerabilities

✅ Cross-Site Scripting (XSS) Attacks

✅ Cross-Site Request Forgery (CSRF) Attacks

✅ Authentication and Authentication Bypass Vulnerabilities

✅ Privilege Escalation Vulnerabilities

✅ Buffer Overflow Vulnerabilities

✅ Denial-of-Service (DoS) Vulnerabilities

✅ Data Leakage Vulnerabilities

✅ Insecure Dependencies

✅ Code Execution Vulnerabilities

✅ File Unauthorized Access Vulnerabilities

✅ Insufficient Injection Protection

Conclusion

Customizer Export/Import version 0.9.8 has received PSC-2026-65716. The certification covers the reviewed export and import controls, settings data, theme matching, and optional image handling. Test a transferred configuration on a staging site when possible and retain a copy of the original settings for recovery.

Note: The date and certification information may change over time. It is advisable to verify the latest details on the plugin developer’s website.