CVE-2020-36503

HIGH

Connections Business Directory WP <9.7 - Code Injection

Title source: llm
STIX 2.1

Description

The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue

References (2)

Core 2
Core References
Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/Connections-Business-Directory/Connections/issues/474
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/dd394b55-c86f-4fa2-aae8-5903ca0b95ec

Scores

CVSS v3 8.0
EPSS 0.0121
EPSS Percentile 64.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-1236
Status published
Products (1)
connections-pro/connections_business_directory 0.7.3.2 - 9.6
Published Nov 01, 2021
Tracked Since Feb 18, 2026