What’s Vulnerable › Vulnerabilities

CVE-2020-36503: Connections Business Directory < 9.7 - Admin+ CSV Injection

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-01 · updated 2026-06-17
• Weakness: CWE-1236

Description

The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue

Affected products

• Connections Business Directory: from 0.7.3.2 through 9.6

References

• https://github.com/Connections-Business-Directory/Connections/issues/474
• https://wpscan.com/vulnerability/dd394b55-c86f-4fa2-aae8-5903ca0b95ec
• https://github.com/Connections-Business-Directory/Connections/issues/474
• https://wpscan.com/vulnerability/dd394b55-c86f-4fa2-aae8-5903ca0b95ec

Get alerted when CVE-2020-36503 or the next vulnerability affects your stack