CVE-2022-3574: WPForms Pro < 1.7.7 - CSV Injection
Published Nov 14, 2022
·Updated
The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.
Affected Software
1 affected component
WPForms WPForms Pro WordPress<1.7.7
Event History
Nov 14, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-3574?
The severity of CVE-2022-3574 is critical with a CVSS score of 9.8.
2
How does CVE-2022-3574 affect WPForms Pro WordPress plugin?
CVE-2022-3574 affects WPForms Pro WordPress plugin version up to exclusive 1.7.7.
3
What is the vulnerability in WPForms Pro WordPress plugin before 1.7.7?
The vulnerability in WPForms Pro WordPress plugin before 1.7.7 is the lack of form data validation when generating exported CSV, leading to CSV injection.