Description
The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
References (3)
Scores
CVSS v3
4.7
EPSS
0.0249
EPSS Percentile
85.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-1236
Status
published
Products (3)
westguard/WS Form LITE – Drag & Drop Contact Form Builder
< 1.9.217
westguardsolutions/ws_form
< 1.9.218 (2 CPE variants)
WS Form/WS Form Pro
< 1.9.217
Published
Jun 07, 2024
Tracked Since
Feb 18, 2026