Vulnerability · Published Nov 7, 2022 · Assigned by WPScan
CVE-2022-3558Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection
High 8.0
In plain English
A high-severity security flaw in Import and export users and customers from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 72% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)1.3%top 28.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Import and export users and customers | 1.20.5 – before 1.20.5 |
Weakness: CWE-1236 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H