CVE-2022-3574: Wpforms Pro

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.

Affected products

• Wpforms Wpforms Pro: before 1.7.7 (fixed in 1.7.7)

Published 2022-11-14. Last modified 2026-06-17.