CVE-2022-2429

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into billing information like their First Name that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-138 CWE-1236

Affected software

Vendor	Product	Versions
homescript	Ultimate SMS Notifications for WooCommerce	>= 1.4.1, <= 1.4.1

References

https://plugins.trac.wordpress.org/browser/ultimate-sms-notifications/trunk/README.txt?rev=2441845#L92Release Notes, Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2429Third Party Advisory
https://plugins.trac.wordpress.org/browser/ultimate-sms-notifications/trunk/README.txt?rev=2441845#L92Release Notes, Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2429Third Party Advisory

Timeline

Published: Sep 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-242907.5A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter CVE-2022-242917.5Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.CVE-2022-242929.8Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.CVE-2022-242939.8Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.CVE-2022-242947.5A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The CVE-2022-242958.8Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially craft CVE-2022-242967.5Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning Syst CVE-2022-242976.7Improper buffer restrictions in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege vi CVE-2022-242987.5All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory co CVE-2022-242998.8Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus softwar CVE-2022-24305.4The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versio CVE-2022-243009.8Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta