CVE-2022-3393

CVE-2022-3393: Post to CSV by BestWebSoft <= 1.4.0 - Author+ CSV Injection

Vendor Unknown

Product Post to CSV by BestWebSoft

Weakness CWE-1236

Published October 25, 2022

Last update May 7, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection

Key dates

02Disclosure timeline

October 25, 2022 CVE published

May 7, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3393 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1236.html AskarLabs — CWE-1236 write-up Improper Neutralization of Formula Elements in a CSV File

Related vulnerabilities

04Related CVE

CVE-2025-8767 AnWP Football Leagues <= 0.16.17 - Authenticated (Administrator+) CSV Injection CVE-2022-1539 Exports and Reports < 0.9.2 - Contributor+ CSV Injection CVE-2022-44738 WordPress Posts and Users Stats Plugin <= 1.1.3 is vulnerable to CSV Injection CVE-2020-36503 Connections Business Directory < 9.7 - Admin+ CSV Injection CVE-2022-47442 WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection