### [CVE-2022-0142](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0142)
![](https://img.shields.io/static/v1?label=Product&message=Visual%20Form%20Builder&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=3.0.8%3C%203.0.8%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1236%20Improper%20Neutralization%20of%20Formula%20Elements%20in%20a%20CSV%20File&color=brighgreen)

### Description

The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.

### POC

#### Reference
- https://wpscan.com/vulnerability/03210390-2054-40c0-9508-39d168087878
- https://wpscan.com/vulnerability/03210390-2054-40c0-9508-39d168087878

#### Github
No PoCs found on GitHub currently.