WordPress Plugin Vulnerabilities

WP CSV Exporter < 1.3.7 - CSV Injection

Description

The plugin does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability.

Proof of Concept

Affects Plugins

Plugin icon
wp-csv-exporter
Fixed in 1.3.7

References

CVE
CVE-2022-3605

Classification

Type
CSV INJECTION
OWASP top 10
A1: Injection
CWE
CWE-1236
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Francesco Carlucci
Submitter
Francesco Carlucci
Submitter website
https://carluc.ci
Submitter twitter
francecarlucci
Verified
Yes
WPVDB ID
28ecdf61-e478-42c3-87c0-80a9912eadb2

Timeline

Publicly Published
2022-11-29 (about 3 years ago)
Added
2022-11-21 (about 3 years ago)
Last Updated
2022-11-21 (about 3 years ago)

Other

Published
Title
Published
2022-11-29
Title
Appointment Hour Booking < 1.3.73 - CSV Injection
Published
2020-05-29
Title
Connections Business Directory < 9.7 - Admin+ CSV Injection
Published
2022-08-16
Title
Affiliates Manager < 2.9.14 - Affiliate CSV Injection
Published
2023-06-08
Title
Metform Elementor Contact Form Builder < 3.3.1 - Unauthenticated CSV Injection
Published
2022-09-28
Title
Easy Digital Downloads < 3.1.0.2 - Unauthenticated CSV Injection