What’s Vulnerable › Vulnerabilities

CVE-2023-5424: WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-07 · updated 2026-06-17
• Weakness: CWE-1236

Description

The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Affected products

• westguard WS Form LITE – Drag & Drop Contact Form Builder: before 1.9.218 — fixed in 1.9.218

How to fix

Upgrade to a fixed version: westguard WS Form LITE – Drag & Drop Contact Form Builder 1.9.218. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3098265%40ws-form&new=3098265%40ws-form&sfp_email=&sfph_mail=
• https://wsform.com/changelog/?utm_source=wp_plugins&utm_medium=readme
• https://www.wordfence.com/threat-intel/vulnerabilities/id/38ccaa81-77ec-46f2-9bec-d74fa2e093f3?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3098265%40ws-form&new=3098265%40ws-form&sfp_email=&sfph_mail=
• https://wsform.com/changelog/?utm_source=wp_plugins&utm_medium=readme
• https://www.wordfence.com/threat-intel/vulnerabilities/id/38ccaa81-77ec-46f2-9bec-d74fa2e093f3?source=cve

Get alerted when CVE-2023-5424 or the next vulnerability affects your stack