{
 "id": "WPSEC-2026-2489",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2489/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2489/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2489/index.md",
 "title": "WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.3 - Authenticated (Contributor+) CSV Injection via Single Post Export",
 "description": "The WP Ultimate CSV Importer plugin for WordPress is vulnerable to CSV Injection via the single post export feature in all versions up to, and including, 9.3, due to insufficient neutralization of formula elements in exported post fields and post meta values. This makes it possible for authenticated attackers, with contributor-level access and above, to embed spreadsheet formulas in post titles, content, excerpts or custom fields. The formulas could run on a user's local system when an administrator exports that post and opens the CSV file in a spreadsheet application.",
 "plugin": {
  "slug": "wp-ultimate-csv-importer",
  "name": "WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export",
  "full_name": "WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export",
  "wordpress_org": "https://wordpress.org/plugins/wp-ultimate-csv-importer/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-ultimate-csv-importer/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-ultimate-csv-importer"
 },
 "type": "CSV INJECTION",
 "cwe": [
  "CWE-1236"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "7.14",
    "from_inclusive": true,
    "to": "9.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 7.14 before 9.3.1"
  ]
 },
 "introduced_in": "7.14",
 "fixed_in": "9.3.1",
 "remediation": "Update to 9.3.1 or later.",
 "fix_released": "2026-11-03T13:31:19+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T13:59:10.587324+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2489/",
  "https://plugins.svn.wordpress.org/wp-ultimate-csv-importer/tags/9.3.1/",
  "https://wordpress.org/plugins/wp-ultimate-csv-importer/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-ultimate-csv-importer",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}