CVE-2019-11872

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-05-29 · updated 2026-06-17
Weakness: CWE-1236

Description

The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the plugin does not sanitize the user's input and allows insertion of any text.

Affected products

Incsub Hustle: before 6.0.8.1 — fixed in 6.0.8.1

How to fix

Upgrade to a fixed version: Incsub Hustle 6.0.8.1. Check the vendor advisory for mitigations.

References

https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin/
https://blog.reddy.io/category/cybersecurity/
https://wordpress.org/plugins/wordpress-popup/#developers
https://wpvulndb.com/vulnerabilities/9326
https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin/
https://blog.reddy.io/category/cybersecurity/
https://wordpress.org/plugins/wordpress-popup/#developers
https://wpvulndb.com/vulnerabilities/9326

Get alerted when CVE-2019-11872 or the next vulnerability affects your stack