Lucene search
Francesco CarlucciWPVDB-ID:28ECDF61-E478-42C3-87C0-80A9912EADB2HistoryNov 29, 2022 - 12:00 a.m.
WP CSV Exporter < 1.3.7 - CSV Injection
2022-11-2900:00:00
Francesco Carlucci
wpscan.com
20
plugin
csv exporter
data escaping
vulnerability
software
csv formula
EPSS
0.001
Percentile
26.6%
The plugin does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability.
PoC
- create a post using =5+5 as the title - export the data as CSV - open the CSV with a spreadsheet application (Excel, Libre Office) - the CSV formula gets executed
Related
wpexploit
wpexploit
WP CSV Exporter < 1.3.7 - CSV Injection
2022-11-29 00:00:00
nvd
nvd
CVE-2022-3605
2022-12-12 18:15:10
cvelist
cvelist
CVE-2022-3605 WP CSV Exporter < 1.3.7 - CSV Injection
2022-12-12 17:54:46
prion
prion
Input validation
2022-12-12 18:15:00
cve
cve
CVE-2022-3605
2022-12-12 18:15:10