CVE-2022-46803

WordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin – Noptin.This issue affects Simple Newsletter Plugin – Noptin: from n/a through 1.9.5.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Noptin

Products

Noptin

CVE-2022-46802

WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Webtoffee

Products

Product Reviews Import Export For Woocommerce

CVE-2022-46801

WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Geminilabs

Products

Site Reviews

CVE-2022-45810

WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a through 5.5.2.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Icegram

Products

Icegram Express

CVE-2022-45370

WordPress WordPress Comments Import & Export Plugin <= 2.3.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Webtoffee

Products

Wordpress Comments Import And Export

CVE-2022-45360

WordPress Commenter Emails Plugin <= 2.6.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Scott Reilly Commenter Emails.This issue affects Commenter Emails: from n/a through 2.6.1.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Coffee2code

Products

Commenter Emails

CVE-2022-45357

WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Lenderd 1003 Mortgage Application.This issue affects 1003 Mortgage Application: from n/a through 1.75.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Lenderd

Products

1003 Mortgage Application

CVE-2022-45350

WordPress Simple History Plugin <= 3.3.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Pär Thernström Simple History – user activity log, audit tool.This issue affects Simple History – user activity log, audit tool: from n/a through 3.3.1.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed

Vendors

Simple-history

Products

Simple History

CVE-2022-45348

WordPress amr users Plugin <= 4.59.4 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in anmari amr users.This issue affects amr users: from n/a through 4.59.4.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Anmari

Products

Amr Users

CVE-2022-44738

WordPress Posts and Users Stats Plugin <= 1.1.3 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: from n/a through 1.1.3.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Patrickrobrecht

Products

Posts And Users Stats

CVE-2022-42882

WordPress Simple CSV/XLS Exporter Plugin <= 1.5.8 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a through 1.5.8.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Shambix

Products

Simple Csv\/xls Exporter

CVE-2022-41616

WordPress Export Users Data CSV Plugin <= 2.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1.

CVSS 3.1 · 7.6 High EPSS 1.0% KEV · Not listed

Vendors

Kaushikkalathiya

Products

Export Users Data

CVE-2022-38702

WordPress WP CSV Exporter Plugin <= 2.0 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Kigurumi

Products

Csv Exporter

CVE-2022-45078

WordPress User Blocker Plugin <= 1.5.5 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Solwin Infotech User Blocker.This issue affects User Blocker: from n/a through 1.5.5.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Solwininfotech

Products

User Blocker

CVE-2022-41791

WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability

Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Metagauss

Products

Profilegrid

CVE-2025-58855

WordPress AP HoneyPot WordPress Plugin Plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability

Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V (Artprima) AP HoneyPot WordPress Plugin ap-honeypot allows Reflected XSS.This issue affects AP HoneyPot WordPress Plugin: from n/a through <= 1.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-8767

AnWP Football Leagues <= 0.16.17 - Authenticated (Administrator+) CSV Injection

The AnWP Football Leagues plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 0.16.17 via the 'download_csv_players' and 'download_csv_games' functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Anwp Wordpress

Products

Football Leagues Wordpress

CVE-2025-11254

Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection

The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Contest-gallery Wordpress

Products

Contest Gallery Wordpress

CVE-2025-11576

AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant <= 1.6.5 - Unauthenticated CSV Injection

The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.6.5. This is due to insufficient sanitization in the 'newcodebyte_chatbot_export_messages' function. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Newcodebyte Wordpress

Products

Ai Chatbot Free Models Wordpress

CVE-2025-13133

Simple User Import Export <= 1.1.7 - Authenticated (Admin+) CSV Injection

The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress