CVE-2023-5527highCWE-1236

CVE-2023-5527: fallo de gravedad alta en strategy11team Business Directory Plugin…

Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Business Directory Plugin – Easy Listing Directories for WordPress

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.4epss 0.5%
The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by administrators, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Productos afectados
strategy11team · Business Directory Plugin – Easy Listing Directories for WordPress
CVEs relacionadas — strategy11team Business Directory Plugin…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-4443CRITICALBusiness Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields ParameterEPSS 10.4%CVE-2026-2576HIGHBusiness Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment ParameterEPSS 0.5%CVE-2026-1656MEDIUMBusiness Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing ModificationEPSS 0.4%CVE-2024-13887MEDIUMBusiness Directory Plugin - Easy Listing Directories for WordPress <= 6.4.14 - Insecure Direct Object Reference to Listing Arbitrary Image AdditionEPSS 0.3%