{
 "id": "WPSEC-2026-1635",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1635/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1635/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1635/index.md",
 "title": "Pz-LinkCard <= 2.6.3 - Unauthenticated CSV Injection via Link Card Data Export",
 "description": "The Pz-LinkCard plugin for WordPress is vulnerable to CSV Injection via the link card CSV export in all versions up to, and including, 2.6.3 due to insufficient neutralization of spreadsheet formula characters in exported fields such as titles and excerpts, which are retrieved from remote pages. This makes it possible for unauthenticated attackers who control a page that is linked as a link card on the site to embed formulas that execute on the local computer of an administrator who exports the data and opens the file in a spreadsheet application.",
 "plugin": {
  "slug": "pz-linkcard",
  "name": "Pz-LinkCard",
  "full_name": "Pz-LinkCard",
  "wordpress_org": "https://wordpress.org/plugins/pz-linkcard/",
  "advisories_url": "https://wpsec.com/vuln/plugin/pz-linkcard/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/pz-linkcard"
 },
 "type": "CSV INJECTION",
 "cwe": [
  "CWE-1236"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.6.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.6.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.6.4",
 "remediation": "Update to 2.6.4 or later.",
 "fix_released": "2026-10-24T06:32:14+00:00",
 "published": "2026-10-25T06:40:42+00:00",
 "updated": "2026-10-24T10:52:58.544530+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1635/",
  "https://plugins.svn.wordpress.org/pz-linkcard/tags/2.6.4/",
  "https://wordpress.org/plugins/pz-linkcard/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/pz-linkcard",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}