CVE-2022-3463: Fluentforms Contact Form

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection

Affected products

• Fluentforms Contact Form: before 4.3.13 (fixed in 4.3.13)

Published 2022-11-07. Last modified 2026-06-17.