What’s Vulnerable › Vulnerabilities

CVE-2022-2240: Request a Quote <= 2.3.7 - CSV Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-25 · updated 2026-06-17
• Weakness: CWE-1236

Description

The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it

Affected products

• Request a Quote: through 2.3.7

References

• https://wpscan.com/vulnerability/6a3a573e-f9f2-45ec-9156-332cc551fc7e
• https://wpscan.com/vulnerability/6a3a573e-f9f2-45ec-9156-332cc551fc7e

Get alerted when CVE-2022-2240 or the next vulnerability affects your stack