CVE-2022-3558CWE-1236

Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection

High · published November 7, 2022

CVSS v3.1
8.0
EPSS
1%
Percentile
65.7
In the wild
Unconfirmed
What it is

The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01111 · 65.7th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2022-11-07T00:00Z
EPSS history
Timeline
  • 07 NOV 00:00Z
    Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection
    cvelistv5