What’s Vulnerable › Vulnerabilities

CVE-2019-20180

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-09 · updated 2026-06-17
• Weakness: CWE-1236

Description

The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.

Affected products

• tobiasbg TablePress – Tables in WordPress made easy: through 1.9.2

References

• https://medium.com/%40Pablo0xSantiago/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8
• https://wordpress.org/support/topic/security-issue-cve-2019-20180-for-tablepress/#post-16282996
• https://wpvulndb.com/vulnerabilities/10016
• https://medium.com/%40Pablo0xSantiago/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8
• https://wordpress.org/support/topic/security-issue-cve-2019-20180-for-tablepress/#post-16282996
• https://wpvulndb.com/vulnerabilities/10016

Get alerted when CVE-2019-20180 or the next vulnerability affects your stack