Vulnerabilities / Pz-LinkCard / WPSEC-2026-1635
Pz-LinkCard <= 2.6.3 - Unauthenticated CSV Injection via Link Card Data Export
Medium 4.7
CWE-1236Fixed in 2.6.4
- ID
- WPSEC-2026-1635
- Plugin
- Pz-LinkCard (pz-linkcard)
- Affected
- all versions before 2.6.4
- Remediation
- Update to 2.6.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-1236
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Pz-LinkCard on WPSec AttackSurface
- Fix released
- Published
Description
The Pz-LinkCard plugin for WordPress is vulnerable to CSV Injection via the link card CSV export in all versions up to, and including, 2.6.3 due to insufficient neutralization of spreadsheet formula characters in exported fields such as titles and excerpts, which are retrieved from remote pages. This makes it possible for unauthenticated attackers who control a page that is linked as a link card on the site to embed formulas that execute on the local computer of an administrator who exports the data and opens the file in a spreadsheet application.
References
- https://wpsec.com/vuln/WPSEC-2026-1635/
- https://plugins.svn.wordpress.org/pz-linkcard/tags/2.6.4/
- https://wordpress.org/plugins/pz-linkcard/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS