CVE-2019-11872 - CVE House
Back to Database
Status published High CVE-2019-11872

The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable...

Vulnerability Description

The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the plugin does not sanitize the user's input and allows insertion of any text.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11872

Credits & Attribution

No credits recorded in the NVD database.

References

More from incsub

View All →
CVE-2019-9568
The "Forminator Contact Form, Poll & Quiz Builder" plugin before...
Medium 6.5
CVE-2019-9567
The "Forminator Contact Form, Poll & Quiz Builder" plugin before...
Medium 6.1
CVE-2018-18576
The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows...
Medium 5.3
CVE-2015-9455
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with...
High 8.1

Affected Vendor

Affected Software

hustle
Vulnerable Versions:
0

Timeline

Official Publish: May 29th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.