Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-9372 | appointment-booking-calendar (WordPress plugin) | The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking | high | 7.8 | 9% |
| CVE-2020-11548 | search-meter (WordPress plugin) | The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could ac | critical | 9.8 | 5% |
| CVE-2019-15092 | import-export-wordpress-users (WordPress plugin) | The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, displ | high | 7.3 | 5% |
| CVE-2018-11525 | woo-order-export-lite (WordPress plugin) | The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection. | high | 7.8 | 5% |
| CVE-2018-11526 | comments-import-export-woocommerce (WordPress plugin) | The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection. | high | 7.8 | 5% |
| CVE-2018-10504 | form-maker (WordPress plugin) | The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection. | high | 7.8 | 4% |
| CVE-2019-16120 | event-tickets (WordPress plugin) | CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Expo | high | 8.8 | 3% |
| CVE-2020-22276 | weforms (WordPress plugin) | WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry. | critical | 9.8 | 3% |
| CVE-2022-0142 | visual-form-builder (WordPress plugin) | The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inje | critical | 9.8 | 3% |
| CVE-2020-7947 | auth0 (WordPress plugin) | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled | critical | 9.8 | 3% |
| CVE-2019-17661 | admin-columns (WordPress plugin) | A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control | high | 8.8 | 2% |
| CVE-2022-1544 | luyadev/yii-helpers | Improper neutralization of formula elements in yii-helpers | high | 7.8 | 2% |
| CVE-2019-20180 | tablepress (WordPress plugin) | The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and ar | medium | 6.8 | 2% |
| CVE-2019-11872 | wordpress-popup (WordPress plugin) | The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a | high | 8.8 | 2% |
| CVE-2020-22275 | easy-registration-forms (WordPress plugin) | Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, whe | high | 8.8 | 2% |
| CVE-2023-29918 | francoisjacquet/rosariosis | RosarioSIS vulnerable to CSV Injection | medium | 5.4 | 2% |
| CVE-2022-3393 | post-to-csv (WordPress plugin) | The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV i | critical | 9.8 | 2% |
| CVE-2020-22277 | import-users-from-csv-with-meta (WordPress plugin) | Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile. | high | 8.0 | 2% |
| CVE-2018-16308 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. | high | 8.6 | 2% |
| CVE-2018-8092 | mautic/core | CSV Injection vulnerability with exported contact lists in Mautic | critical | 9.8 | 2% |
| CVE-2022-1539 | exports-and-reports (WordPress plugin) | The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lea | high | 8.8 | 2% |
| CVE-2018-15571 | export-users-to-csv (WordPress plugin) | The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection. | high | 8.6 | 1% |
| CVE-2022-3026 | wp-users-exporter (WordPress plugin) | The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' fun | medium | 6.5 | 1% |
| CVE-2022-3574 | wpforms-pro (WordPress plugin) | The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV inje | critical | 9.8 | 1% |
| CVE-2022-2240 | request-a-quote (WordPress plugin) | The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a maliciou | high | 8.8 | 1% |
| CVE-2021-41270 | symfony/serializer, symfony/symfony | CSV Injection in symfony/serializer | medium | 6.5 | 1% |
| CVE-2021-41824 | craftcms/cms | CSV Injection Vulnerability | high | 8.8 | 1% |
| CVE-2022-3463 | contact-form (WordPress plugin) | The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a | critical | 9.8 | 1% |
| CVE-2020-9466 | export-users-to-csv (WordPress plugin) | The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection. | medium | 6.1 | 1% |
| CVE-2021-24441 | sign-up-sheets (WordPress plugin) | The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which | high | 8.0 | 1% |
| CVE-2022-1194 | mobile-events-manager (WordPress plugin) | The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid | high | 8.8 | 1% |
| CVE-2020-36503 | connections-business-directory (WordPress plugin) | The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a | high | 8.0 | 1% |
| CVE-2022-2798 | affiliates-manager (WordPress plugin) | The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering | high | 8.0 | 1% |
| CVE-2022-3558 | import-users-from-csv-with-meta (WordPress plugin) | The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. | high | 8.0 | 1% |
| CVE-2021-37702 | pimcore/pimcore | Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore | medium | 0.0 | 1% |
| CVE-2021-43515 | kevinpapst/kimai2 | Improper Neutralization of Formula Elements in a CSV File in Kimai 2 | high | 7.8 | 1% |
| CVE-2022-1202 | wp-crm (WordPress plugin) | The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV inject | high | 7.8 | 1% |
| CVE-2021-43257 | mantisbt/mantisbt | MantisBT CSV Injection unprivileged user access in csv_export.php | high | 7.8 | 1% |
| CVE-2022-2429 | ultimate-sms-notifications (WordPress plugin) | The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 v | medium | 6.5 | 1% |
| CVE-2022-27858 | activity-log (WordPress plugin) | CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress. | high | 7.4 | 1% |
| CVE-2022-45370 | wordpress-comments-import-and-export (WordPress plugin) | Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects W | medium | 6.1 | 1% |
| CVE-2023-4006 | thorsten/phpmyfaq | phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability | high | 8.8 | 1% |
| CVE-2024-3214 | relevanssi (WordPress plugin) | The Relevanssi – A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This make | medium | 5.8 | 1% |
| CVE-2022-38061 | export-post-info (WordPress plugin) | Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress. | medium | 6.2 | 1% |
| CVE-2022-41791 | profilegrid (WordPress plugin) | Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress. | medium | 6.8 | 1% |
| CVE-2023-0721 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This | high | 8.3 | 1% |
| CVE-2022-4034 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it pos | medium | 5.8 | 1% |
| CVE-2025-55745 | unopim/unopim | UnoPim has CSV Injection on Quick Export feature | low | 0.0 | 1% |
| CVE-2022-45810 | icegram-express (WordPress plugin) | Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automa | medium | 4.7 | 1% |
| CVE-2023-41798 | directorist (WordPress plugin) | Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Clas | medium | 5.1 | 1% |