CVE-2021-24441: Sign-up Sheets < 1.0.14 - Authenticated CSV Injection

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-07-12 · updated 2026-06-17
Weakness: CWE-1236

Description

The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue

Affected products

Fetch Designs Sign-up Sheets: before 1.0.14 — fixed in 1.0.14

How to fix

Upgrade to a fixed version: Fetch Designs Sign-up Sheets 1.0.14. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/ec9292b1-5cbd-4332-bdb6-2351c94f5ac6
https://wpscan.com/vulnerability/ec9292b1-5cbd-4332-bdb6-2351c94f5ac6

Get alerted when CVE-2021-24441 or the next vulnerability affects your stack