WordPress Plugin Vulnerabilities

Activity Log < 2.8.4 - CSV Injection

Description

The plugin does not validate data when output it back in a CSV file, which could lead to CSV injection

Affects Plugins

Plugin icon
aryo-activity-log
Fixed in 2.8.4

References

CVE
CVE-2022-27858

Classification

Type
CSV INJECTION
OWASP top 10
A1: Injection
CWE
CWE-1236
CVSS
3.6 (low)

Miscellaneous

Original Researcher
Universe
Verified
No
WPVDB ID
d43c4ff8-fec5-4202-b534-afdded91ed65

Timeline

Publicly Published
2022-09-25 (about 3 years ago)
Added
2022-11-08 (about 3 years ago)
Last Updated
2022-11-08 (about 3 years ago)

Other

Published
Title
Published
2025-11-17
Title
Simple User Import Export <= 1.1.7 - Authenticated (Admin+) CSV Injection
Published
2021-06-21
Title
Sign-up Sheets < 1.0.14 - Authenticated CSV Injection
Published
2025-08-11
Title
AnWP Football Leagues < 0.16.18 - Authenticated (Administrator+) CSV Injection
Published
2020-11-20
Title
weForms < 1.6.4 - CSV Injection
Published
2022-11-09
Title
Export customers list CSV for WooCommerce < 2.0.69 - CSV Injection