WPScan
How it worksPricing
Vulnerabilities
WordPressPluginsThemesStatsSubmit vulnerabilities
For developers
StatusAPI detailsCLI scanner
Contact

WordPress Plugin Vulnerabilities

weForms < 1.6.4 - CSV Injection

Description

The plugin allows CSV injection via a form's entry

Affects Plugins

weforms
Fixed in version 1.6.4

References

CVE
CVE-2020-22276
URL
https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22276.pdf
URL
https://github.com/BoldGrid/weforms/pull/50/files

Classification

Type

CSV INJECTION

OWASP top 10
A1: Injection
CWE
CWE-1236

Miscellaneous

Original Researcher

Mohamad Pishdar (cert.ikiu.ac.ir)

Verified

No

WPVDB ID
02bb301b-8880-40e8-a260-de586bc589a1

Timeline

Publicly Published

2020-11-20 (about 1 years ago)

Added

2020-11-20 (about 1 years ago)

Last Updated

2020-12-25 (about 1 years ago)

Our Other Services

WPScan WordPress Security Plugin