CVE-2019-20180

The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users.

6.8 MediumDisputed

CVE-2019-20180 is a medium vulnerability (CVSS 6.8) in Tablepress, published January 9, 2020. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 2.33%, the 83rd percentile.

The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.33%Up 1.7 points since Apr 14, 2021

What each source reports

NVD Score used 6.8

Record: CVE-2019-20180
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness: CWE-1236
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-20180
Updated: 2026-11-02

EUVDEUVD-2019-10734 No score

Record: EUVD-2019-10734
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hp3g-5vj7-7hgc 6.8

The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users.

The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users.

Record: GHSA-hp3g-5vj7-7hgc
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-1236
Updated: 2026-11-02

OSV 6.8

Record: CVE-2019-20180
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

tablepress

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV