CVE-2022-3558

🗓️ 07 Nov 2022 00:00:00Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 80 Views🌐 WEB

The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. NV

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2022-3558	7 Nov 202212:34	–	circl
CNNVD	WordPress plugin Import and export users and customers 安全漏洞	7 Nov 202200:00	–	cnnvd
Cvelist	CVE-2022-3558 Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection	7 Nov 202200:00	–	cvelist
EUVD	EUVD-2022-42924	3 Oct 202520:07	–	euvd
NVD	CVE-2022-3558	7 Nov 202210:15	–	nvd
OSV	CVE-2022-3558	7 Nov 202210:15	–	osv
Prion	Code injection	7 Nov 202210:15	–	prion
Positive Technologies	PT-2022-22908 · WordPress · Export/Import Users/Customers	7 Nov 202200:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2022-3558: Improper Neutralization of Formula Elements in a CSV File	7 Nov 202200:00	–	rapid7
RedhatCVE	CVE-2022-3558	22 May 202523:14	–	redhatcve

NVD

Vulners

Node

codection import_and_export_users_and_customersRange<1.20.5wordpress

[
  {
    "vendor": "Unknown",
    "product": "Import and export users and customers",
    "versions": [
      {
        "version": "1.20.5",
        "status": "affected",
        "lessThan": "1.20.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
wpscan	www.wpscan.com/vulnerability/e3d72e04-9cdf-4b7d-953e-876e26abdfc6

Parameter	Position	Path	Description	CWE
nickname	path	wp-admin/tools.php?page=acui&tab=export	Exported CSV from the vulnerable plugin does not escape data, enabling CSV/Excel formula injection via the nickname field.	CWE-1236

17 Jun 2026 04:59Current

7.9High risk

Vulners AI Score7.9

CVSS 3.18

EPSS0.01089

SSVC

CWE-1236