{
 "id": "WPSEC-2026-2465",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2465/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2465/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2465/index.md",
 "title": "Ninja Job Board <= 1.4.0 - Unauthenticated CSV Injection via Application Field Values",
 "description": "The ninja-job-board plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.4.0. This is due to submitted application field values being written to the CSV export without neutralizing leading formula characters such as =, +, - and @. This makes it possible for unauthenticated attackers to embed malicious formulas in an application that execute when an administrator exports the applications and opens the file in a spreadsheet program.",
 "plugin": {
  "slug": "ninja-job-board",
  "name": "Ninja Job Board",
  "full_name": "Ninja Job Board – Ultimate WordPress Job Board Plugin",
  "wordpress_org": "https://wordpress.org/plugins/ninja-job-board/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ninja-job-board/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ninja-job-board"
 },
 "type": "CSV INJECTION",
 "cwe": [
  "CWE-1236"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.0.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.0.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.0.0",
 "remediation": "Update to 2.0.0 or later.",
 "fix_released": "2026-11-03T10:23:22+00:00",
 "published": "2026-11-04T10:54:55+00:00",
 "updated": "2026-11-03T13:23:23.714015+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2465/",
  "https://plugins.svn.wordpress.org/ninja-job-board/tags/2.0.0/",
  "https://wordpress.org/plugins/ninja-job-board/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ninja-job-board",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}