WordPress Plugin Vulnerabilities

Hustle < 6.0.8.1 - Unauthenticated CSV Injection

Description

The Hustle – Email Marketing, Lead Generation, Optins, Popups WordPress plugin was affected by an Unauthenticated CSV Injection security vulnerability.

Affects Plugins

Plugin icon
wordpress-popup
Fixed in 6.0.8.1

References

CVE
CVE-2019-11872
URL
https://web.archive.org/web/20191112060019/https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin/
URL
https://plugins.trac.wordpress.org/changeset/2085075/wordpress-popup

Miscellaneous

Original Researcher
Mark Parfeniuk (REDdy Solutions)
Submitter
Ryan Dewhurst
Submitter website
https://wpscan.io
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
b9502301-3cc4-4ab0-a223-5bfdca33b0b9

Timeline

Publicly Published
2019-05-24 (about 6 years ago)
Added
2019-05-31 (about 6 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2014-08-01
Title
Image slider with description - Unspecified
Published
2023-10-25
Title
All In One WP Security < 5.2.5 - Protection Bypass of Renamed Login Page via URL Encoding
Published
2015-01-17
Title
Store Locator Plus 4.2.23 - Email Injection
Published
2018-12-13
Title
WordPress <= 5.0 - Authenticated File Delete
Published
2023-06-28
Title
Active Directory Integration / LDAP Integration < 4.1.6 - Sensitive Information Disclosure