CVE-2022-0142

Visual Form Builder < 3.0.6 - CSV Injection

State: Published
Severity: Not scored
Published: Apr 12, 2022
Updated: Aug 2, 2024
Reserved: Jan 6, 2022

Description

The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.

Scores

The record has no CVSS score.

Weaknesses

CWE-1236 Improper Neutralization of Formula Elements in a CSV File

Affected Products

Product	Versions
Visual Form BuilderUnknown	3.0.8 to before 3.0.8Affected

References

https://wpscan.com/vulnerability/03210390-2054-40c0-9508-39d168087878
https://www.fortiguard.com/zeroday/FG-VD-21-080

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.