CVE-2023-5424

WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection

4.7 Medium

The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.49%Up 0.4 points since Jun 8, 2024

What each source reports

CVE List Score used 4.7

WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection

Record: CVE-2023-5424
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-02

EUVDEUVD-2023-57739 4.7

Record: EUVD-2023-57739
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cqx6-vqmj-2pph 4.7

The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and...

Record: GHSA-cqx6-vqmj-2pph
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-02

NVD 4.7

Record: CVE-2023-5424
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-1236
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-5424 is a medium vulnerability (CVSS 4.7) in Westguardsolutions Ws Form, published June 7, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. No source names a fixed version.