# Pz-LinkCard <= 2.6.3 - Unauthenticated CSV Injection via Link Card Data Export

- **ID:** WPSEC-2026-1635
- **Plugin:** Pz-LinkCard (`pz-linkcard`), https://wordpress.org/plugins/pz-linkcard/
- **Affected versions:** all versions before 2.6.4
- **Fixed in:** 2.6.4 (Update to 2.6.4 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-1236
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/pz-linkcard
- **Fix released:** 2026-10-24
- **Published:** 2026-10-25
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1635/

## Description

The Pz-LinkCard plugin for WordPress is vulnerable to CSV Injection via the link card CSV export in all versions up to, and including, 2.6.3 due to insufficient neutralization of spreadsheet formula characters in exported fields such as titles and excerpts, which are retrieved from remote pages. This makes it possible for unauthenticated attackers who control a page that is linked as a link card on the site to embed formulas that execute on the local computer of an administrator who exports the data and opens the file in a spreadsheet application.

## References

- https://wpsec.com/vuln/WPSEC-2026-1635/
- https://plugins.svn.wordpress.org/pz-linkcard/tags/2.6.4/
- https://wordpress.org/plugins/pz-linkcard/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1635/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.