CVE-2022-0142 Visual Form Builder < 3.0.6 - CSV Injection

2022-04-1211:15:23

CWE-1236

WPScan

www.cve.org

visual form builder

wordpress

cve-2022-0142

csv injection

code execution

AI Score

Confidence

High

EPSS

0.003

Percentile

70.0%

JSON

The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.

CNA Affected

[
  {
    "product": "Visual Form Builder",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.0.8",
        "status": "affected",
        "version": "3.0.8",
        "versionType": "custom"
      }
    ]
  }
]