CVE-2022-1539

The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks.

Score

CVSS 3.1 8.8 High

Status

Modified - contact@wpscan.com

Published

2022-07-25

Last modified

2024-08-03

Weaknesses

CWE-1236

Affected products

• Exports And Reports (Exports And Reports Project)
• Exports And Reports (Unknown)

References

• https://wpscan.com/vulnerability/50f70927-9677-4ba4-a388-0a41ed356523