QwikSec

Security Database

CVE

CWE

Training

CVE-2019-11872

Published: May 29, 2019

Modified: Aug 4, 2024

PUBLISHED

Description

The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the plugin does not sanitize the user's input and allows insertion of any text.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://wordpress.org/plugins/wordpress-popup/#developers

x_refsource_MISC

https://blog.reddy.io/category/cybersecurity/

x_refsource_MISC

https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin/

x_refsource_MISC

https://wpvulndb.com/vulnerabilities/9326

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.