CVE-2022-1539

CVE-2022-1539: Exports and Reports < 0.9.2 - Contributor+ CSV Injection

Vendor Unknown

Product Exports and Reports

Weakness CWE-1236

Published July 25, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks.

Key dates

02Disclosure timeline

July 25, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1539 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1236.html AskarLabs — CWE-1236 write-up Improper Neutralization of Formula Elements in a CSV File

Related vulnerabilities

04Related CVE

CVE-2022-38702 WordPress WP CSV Exporter Plugin <= 2.0 is vulnerable to CSV Injection CVE-2025-58855 WordPress AP HoneyPot WordPress Plugin Plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability CVE-2025-13133 Simple User Import Export <= 1.1.7 - Authenticated (Admin+) CSV Injection CVE-2022-46803 WordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV Injection CVE-2022-45078 WordPress User Blocker Plugin <= 1.5.5 is vulnerable to CSV Injection