CVE-2022-3603

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Nov 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-360309.8Project-nexus is a general-purpose blog website framework. Affected versions are subject to SQL injection due to a lack of sensitization of CVE-2022-360316.5Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorize CVE-2022-360325.3ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with CVE-2022-360336.1jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly saniti CVE-2022-360347.5nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue CVE-2022-360357.8Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to conf CVE-2022-360367.8mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less tha CVE-2022-360375.4kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site s CVE-2022-360387.8CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution (RCE) vulnera CVE-2022-360397.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to out-of-bounds write CVE-2022-36047.8The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injecti CVE-2022-360407.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds wri