CRITICAL🇬🇧 English

CVE-2022-3574

CVSS 9.8v3.1pub. 2022-11-14upd. 2025-04-30

The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Wpforms Pro

    APP
    Wpforms
    < 1.7.7
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2024-11205HIGH8.5ten sam vendor

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit...

CVE-2023-7063HIGH7.2ten sam vendor

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission paramete...

CVE-2019-25145HIGH7.2ten sam vendor

The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘pub...

CVE-2020-36919MEDIUM5.1ten sam vendor

WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parame...

CVE-2024-11272MEDIUM6.1ten sam vendor

The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise an...