CVE-2019-20180 Other in n/a
Editor users can inject malicious formulas into TablePress CSV exports, potentially leading to code execution when opened in spreadsheet applications.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-20180?
CVE-2019-20180 is a medium-severity vulnerability in n/a, published on 9 Jan 2020. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.
Weakness: CWE-1236
Which versions are affected by CVE-2019-20180?
It affects 1 product.
Products include Tablepress Tablepress.
How do I fix CVE-2019-20180?
No fix has been published for CVE-2019-20180 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-20180 being exploited?
There is no known exploitation of CVE-2019-20180 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2025-5096 TablePress <= 3.1.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters
- CVE-2025-2685 TablePress – Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2024-9595 TablePress <= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2024-4354 TablePress – Tables in WordPress made easy <= 2.3 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebind
- CVE-2017-10889 XML external entity in TablePress
Sources
Also known as GHSA-hp3g-5vj7-7hgc.