CVE-2022-3558 - Import and export users and customers < 1.20.5

HIGH

Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection

Published Nov 7, 2022

8.0

HIGH

CVSS 3.1

EPSS 1.09%

The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Import and export users and customers

n/a

Version	Status	Constraints
1.20.5	affected	<1.20.5

No remediation recorded yet.

Weaknesses (1)

CWE-1236

Link	Providers	Tags
https://plugins.trac.wordpress.org/changeset?new=2798139%40import-users-from-csv-with-meta&old=2785785%40import-users-from-csv-with-meta		PatchThird Party Advisory
https://wpscan.com/vulnerability/e3d72e04-9cdf-4b7d-953e-876e26abdfc6		ExploitThird Party Advisory

No recorded changes yet.

Sources

Status PUBLISHED

Assigner WPScan

Published Nov 7, 2022

Updated May 1, 2025

Reserved Oct 17, 2022

Updated May 1, 2025

Status Modified

Modified Jun 17, 2026

Severity n/a

Public date n/a