CVE-2019-20180

The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
mitreCNA
---
---
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 86%
VendorProductVersion
tablepresstablepress
𝑥
≤ 1.9.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://medium.com/%40Pablo0xSantiago/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8
https://wordpress.org/support/topic/security-issue-cve-2019-20180-for-tablepress/#post-16282996
https://wpvulndb.com/vulnerabilities/10016
https://medium.com/%40Pablo0xSantiago/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8
https://wordpress.org/support/topic/security-issue-cve-2019-20180-for-tablepress/#post-16282996
https://wpvulndb.com/vulnerabilities/10016