What the vulnerability does
01Description
The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into profile information like First Names that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Explanation of Vulnerability in Simple Terms
02Summary
WP Users Exporter versions up to 1.4.2 contain a cross-site scripting vulnerability triggered when a logged-in user visits a malicious page. The flaw allows an attacker to inject malicious scripts that execute in the victim's browser, potentially stealing session data or performing actions on their behalf. The vulnerability requires user interaction and affects the broader site scope.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in a logged-in user's browser to steal data or perform actions as that user.
Potential impact on your site
04Site Impact
Logged-in users can be tricked into executing attacker code, risking account compromise and unauthorized site modifications.
Conditions required to exploit
05Prerequisites
Attacker needs a low-privilege account or network access; victim must click a malicious link or visit an attacker-controlled page.
Key dates
06Disclosure timeline
September 6, 2022
CVE published
April 8, 2026
Record updated
