Vulnerabilities / Ninja Job Board / WPSEC-2026-2465
Ninja Job Board <= 1.4.0 - Unauthenticated CSV Injection via Application Field Values
Medium 5.4
CWE-1236Fixed in 2.0.0
- ID
- WPSEC-2026-2465
- Plugin
- Ninja Job Board – Ultimate WordPress Job Board Plugin (ninja-job-board)
- Affected
- all versions before 2.0.0
- Remediation
- Update to 2.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weakness
- CWE-1236
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- Ninja Job Board on WPSec AttackSurface
- Fix released
- Published
Description
The ninja-job-board plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.4.0. This is due to submitted application field values being written to the CSV export without neutralizing leading formula characters such as =, +, - and @. This makes it possible for unauthenticated attackers to embed malicious formulas in an application that execute when an administrator exports the applications and opens the file in a spreadsheet program.
References
- https://wpsec.com/vuln/WPSEC-2026-2465/
- https://plugins.svn.wordpress.org/ninja-job-board/tags/2.0.0/
- https://wordpress.org/plugins/ninja-job-board/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS