Vulnerabilities / Contact Form Widget / WPSEC-2026-0374
Contact Form Widget <= 1.5.2 - Unauthenticated CSV Injection via Contact Form Submissions
Medium 6.1
CWE-1236Fixed in 1.5.3
- ID
- WPSEC-2026-0374
- Plugin
- Contact Form Widget – Responsive Contact Form, Query Form & Form Builder (new-contact-form-widget)
- Affected
- all versions before 1.5.3
- Remediation
- Update to 1.5.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-1236
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Contact Form Widget on WPSec AttackSurface
- Fix released
- Published
Description
The Contact Form Widget plugin for WordPress is vulnerable to CSV Injection via contact form submissions in all versions up to, and including, 1.5.2. This is due to insufficient neutralization of formula elements in the name, email and subject values written to the administrator's CSV export of contact queries. This makes it possible for unauthenticated attackers to submit values beginning with characters such as =, +, - or @ that are placed in the exported file. Those values may be run as formulas when an administrator exports the queries and opens the CSV file in a spreadsheet application.
References
- https://wpsec.com/vuln/WPSEC-2026-0374/
- https://plugins.svn.wordpress.org/new-contact-form-widget/tags/1.5.3/
- https://wordpress.org/plugins/new-contact-form-widget/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS