CVE-2022-3574

CVE-2022-3574: WPForms Pro < 1.7.7 - CSV Injection

Vendor Unknown

Product WPForms Pro

Weakness CWE-1236

Published November 14, 2022

Last update April 30, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.

Key dates

02Disclosure timeline

November 14, 2022 CVE published

April 30, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3574 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1236.html AskarLabs — CWE-1236 write-up Improper Neutralization of Formula Elements in a CSV File

Related vulnerabilities

04Related CVE

CVE-2025-8767 AnWP Football Leagues <= 0.16.17 - Authenticated (Administrator+) CSV Injection CVE-2025-11254 Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection CVE-2022-1539 Exports and Reports < 0.9.2 - Contributor+ CSV Injection CVE-2020-36503 Connections Business Directory < 9.7 - Admin+ CSV Injection CVE-2025-13133 Simple User Import Export <= 1.1.7 - Authenticated (Admin+) CSV Injection