Skip to main content

Profilegrid CVE-2022-41791

MEDIUM
Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
2022-11-17 audit@patchstack.com
Code Injection WordPress Profilegrid
6.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.8 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
Low

Lifecycle Timeline

1
CVE Published
Nov 17, 2022 - 23:15 cve.org
MEDIUM 6.8

DescriptionCVE.org

Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.

AnalysisAI

Auth. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1236. Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress. Affected products include: Metagauss Profilegrid.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Profilegrid

View all
CVE-2024-30491 HIGH
8.5 Mar 29

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
CVE-2024-30490 CRITICAL POC
9.3 Mar 29

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
CVE-2023-0940 HIGH POC
8.8 Mar 20

The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not imple
CVE-2019-15873 HIGH POC
8.8 Sep 03

The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an

CVE-2022-3578 MEDIUM POC
6.1 Nov 14

The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the

CVE-2024-30241 HIGH
8.5 Mar 28

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
CVE-2025-0724 HIGH
8.8 Mar 22

The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in al
CVE-2024-6411 HIGH
8.8 Jul 10

The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in al
CVE-2023-3713 HIGH
8.8 Jul 18

The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec
CVE-2026-57759 HIGH
8.8 Jul 02

Cross-site request forgery in the ProfileGrid - User Profiles, Groups and Communities WordPress plugin (versions 5.9.9.7
CVE-2024-37453 HIGH
8.8 Nov 01

Missing Authorization vulnerability in ProfileGrid User Profiles ProfileGrid allows Exploiting Incorrectly Configured Ac
CVE-2024-32774 HIGH
8.8 May 17

Improper Restriction of Excessive Authentication Attempts vulnerability in Metagauss ProfileGrid allows Removing Importa

Same weakness CWE-1236 – Improper Neutralization of Formula Elements in a CSV File

View all
CVE-2019-14749 HIGH POC
8.8
CVE-2020-36962 CRITICAL POC
9.8
CVE-2023-46401 CRITICAL POC
9.8
CVE-2025-56267 CRITICAL POC
9.8
CVE-2021-47901 CRITICAL POC
9.8
CVE-2020-36941 CRITICAL POC
9.8
CVE-2022-3574 CRITICAL POC
9.8
CVE-2022-3463 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Share

CVE-2022-41791 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy