CVE-2020-9466

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1236

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://wpvulndb.com/vulnerabilities/10094Third Party Advisory
https://www.getastra.com/blog/911/plugin-exploit/csv-injection-in-export-users-to-csv-wordpress-plugin/Third Party Advisory
https://www.jinsonvarghese.com/csv-injection-in-export-users-to-csv-plugin/Third Party Advisory
https://wpvulndb.com/vulnerabilities/10094Third Party Advisory
https://www.getastra.com/blog/911/plugin-exploit/csv-injection-in-export-users-to-csv-wordpress-plugin/Third Party Advisory
https://www.jinsonvarghese.com/csv-injection-in-export-users-to-csv-plugin/Third Party Advisory

Timeline

Published: Feb 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-94675.4Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.CVE-2020-94684.3The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, CVE-2020-94707.8An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local us CVE-2020-94718.8Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.CVE-2020-94726.5Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.CVE-2020-94736.6The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 has a passwordless ftp ssh user. By using an exploit chain, an attacker with acce CVE-2020-94748.8The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the backup functionality in the web frontend. By CVE-2020-94757.0The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows local privilege escalation via a race condition in logrotate. By using an CVE-2020-94767.5ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performing CVE-2020-94779.8An issue was discovered on HUMAX HGA12R-02 BRGCAA 1.1.53 devices. A vulnerability in the authentication functionality in the web-based inter CVE-2020-94788.8An issue was discovered in Rubrik 5.0.3-2296. An OS command injection vulnerability allows an authenticated attacker to remotely execute arb CVE-2020-94795.5When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected