CVE-2022-0142

CVE-2022-0142: Visual Form Builder < 3.0.6 - CSV Injection

Vendor Unknown

Product Visual Form Builder

Weakness CWE-1236

Published April 12, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.

Key dates

02Disclosure timeline

April 12, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0142 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1236.html AskarLabs — CWE-1236 write-up Improper Neutralization of Formula Elements in a CSV File

Related vulnerabilities

04Related CVE

CVE-2022-1539 Exports and Reports < 0.9.2 - Contributor+ CSV Injection CVE-2025-11254 Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection CVE-2023-25983 WordPress KB Support Plugin <= 1.5.84 is vulnerable to CSV Injection CVE-2022-3574 WPForms Pro < 1.7.7 - CSV Injection CVE-2022-44738 WordPress Posts and Users Stats Plugin <= 1.1.3 is vulnerable to CSV Injection