CVE-2019-11872 - The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window

Back Back to CVE browser

HIGH

The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window

Published May 29, 2019

8.8

HIGH

CVSS 3.1

EPSS 2.24%

Description

The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the plugin does not sanitize the user's input and allows insertion of any text.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1236

References (5)

https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin/
x_refsource_MISCBroken LinkExploitThird Party Advisory
https://blog.reddy.io/category/cybersecurity/
x_refsource_MISCBroken LinkExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3532
Advisory
https://wordpress.org/plugins/wordpress-popup/#developers
x_refsource_MISCRelease Notes
https://wpvulndb.com/vulnerabilities/9326
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin/		x_refsource_MISCBroken LinkExploitThird Party Advisory
https://blog.reddy.io/category/cybersecurity/		x_refsource_MISCBroken LinkExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3532		Advisory
https://wordpress.org/plugins/wordpress-popup/#developers		x_refsource_MISCRelease Notes
https://wpvulndb.com/vulnerabilities/9326		x_refsource_MISCThird Party Advisory