Vulnerability · Published Jul 12, 2021 · Assigned by WPScan
CVE-2021-24441Sign-up Sheets < 1.0.14 - Authenticated CSV Injection
High 8.0
In plain English
A high-severity security flaw in Sign-up Sheets from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS NVD)8.0High
Exploit odds (30 days)1.3%top 29.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Sign-up Sheets | 1.0.14 – before 1.0.14 |
Weakness: CWE-1236
References
- https://wpscan.com/vulnerability/ec9292b1-5cbd-4332-bdb6-2351c94f5ac6 x_refsource_CONFIRM