PT-2022-12990 · WordPress · Visual Form Builder

Name of the Vulnerable Software and Affected Versions: Visual Form Builder WordPress plugin versions prior to 3.0.6 Description: The issue allows unauthenticated users to see form entries or export them as a CSV file due to a lack of access control on entry form export. This can be done using the...

CVE-2022-0142: Improper Neutralization of Formula Elements in a CSV File

The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution...

CVE-2022-0140: Missing Authentication for Critical Function

The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint...

CVE-2022-0914

The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages including private and draft into an arbitrary CSV file, which the attacker can then download and retrieve the list of...

CVE-2022-0914

The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages including private and draft into an arbitrary CSV file, which the attacker can then download and retrieve the list of...

CVE-2022-0914

The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages including private and draft into an arbitrary CSV file, which the attacker can then download and retrieve the list of...

CVE-2022-0892

The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

Cross site request forgery (csrf)

The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages including private and draft into an arbitrary CSV file, which the attacker can then download and retrieve the list of...

CVE-2022-0914

The CVE-2022-0914 entry concerns the WordPress plugin “Export All URLs” (before version 4.3). According to connected sources (Red Hat, NVD, CVE records, Patchstack), the vulnerability is a CSRF flaw that can allow a logged-in admin to export all posts and pages (including private/draft) into an a...

CVE-2022-0914 Export All URLs < 4.3 - Private/Draft Post/Page Title Disclosure via CSRF

The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages including private and draft into an arbitrary CSV file, which the attacker can then download and retrieve the list of...

CVE-2022-0892

The CVE-2022-0892 entry concerns the WordPress plugin Export All URLs (versions before 4.2). The root cause is improper sanitization/escaping of the CSV filename when outputting it on the page, which enables a Reflected Cross-Site Scripting (XSS) attack. Documented impact is a reflected XSS in pa...

WordPress plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions prior to WordPress plugin LayerSlider 7.1.2. Th...

PT-2022-13506

Name of the Vulnerable Software and Affected Versions Export All URLs WordPress plugin versions prior to 4.2 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitise and escape the CSV filename before displaying it on th...

CVE-2022-0892: Improper Neutralization of Input During Web Page Generation

The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0914: Cross-Site Request Forgery (CSRF)

The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages including private and draft into an arbitrary CSV file, which the attacker can then download and retrieve the list of...

PT-2022-13522

Name of the Vulnerable Software and Affected Versions Export All URLs WordPress plugin versions prior to 4.3 Description The issue allows attackers to make a logged-in admin export all posts and pages, including private and draft ones, into an arbitrary CSV file. This could enable the attacker to...

WordPress Import and export users and customers plugin <= 1.19.2 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by 0x23.so in WordPress Import and export users and customers plugin versions = 1.19.2. Solution Update the WordPress Import and export users and customers plugin to the latest available version at least 1.19.2.1...

Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues As admin, import the below CSV file via Tools Import and export users and customers /wp-admin/tools.php?page=acui...

CVE-2021-43515

CSV Injection aka Excel Macro Injection or Formula Injection exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file...

CVE-2021-43515: Improper Neutralization of Formula Elements in a CSV File

CSV Injection aka Excel Macro Injection or Formula Injection exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file...