# Starfish Review Generation & Marketing for WordPress <= 3.1.31 - Unauthenticated CSV Injection via Feedback Export

- **ID:** WPSEC-2026-2013
- **Plugin:** Starfish Review Generation & Marketing for WordPress (`starfish-reviews`), https://wordpress.org/plugins/starfish-reviews/
- **Affected versions:** all versions before 3.1.32
- **Fixed in:** 3.1.32 (Update to 3.1.32 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-1236
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/starfish-reviews
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2013/

## Description

The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to CSV Injection via the feedback CSV export in all versions up to, and including, 3.1.31. Visitor-supplied feedback fields were written into CSV cells without neutralising values that begin with characters such as =, +, - or @. This makes it possible for unauthenticated attackers to plant formulas in feedback submissions. The formulas run when an administrator exports the feedback and opens the file in spreadsheet software.

## References

- https://wpsec.com/vuln/WPSEC-2026-2013/
- https://plugins.svn.wordpress.org/starfish-reviews/tags/3.1.32/
- https://wordpress.org/plugins/starfish-reviews/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2013/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.