Cyber Resilience

CVE-2023-5424

Medium

Published: 07 June 2024

Published
07 June 2024
Modified
08 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score 0.0249 85.6th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-5424 is a medium-severity Improper Neutralization of Formula Elements in a CSV File (CWE-1236) vulnerability in Westguardsolutions Ws Form. Its CVSS base score is 4.7 (Medium).

Operationally, ranked in the top 14.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files…

more

are downloaded and opened on a local system with a vulnerable configuration.

CWE(s)
CWE-1236

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

westguardsolutions
ws form
≤ 1.9.218 · ≤ 1.9.218

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References