High · 7.8 CVE-2022-3604 EUVD-2022-42967GHSA-fpx6-qj6w-4m83

Contact Form Entries < 1.3.0 - CSV Injection

Published Jan 16, 2024 · Updated Jun 11, 2025 · Assigned by WPScan

Description

The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection.

Vendor	Product	Affected	Fixed
—	Contact Form Entries	< 1.3.0	1.3.0