Events Manager – Calendar, Bookings, Tickets, and more!, ad011e106b92cec79f84c6b75a40aaeb9fe62160
- CVE, Research URL
- Published on
- Feb 05, 2020
- Research Description
- Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.7.2 Events Manager <= 5.9.7.1 - CSV Injection The Events Manager plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 5.9.7.1 through the use of the Microsoft Excel DDE function. This allows low-privileged attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
- Affected versions
-
max 5.9.7.2.
- Status
-
vulnerable