title: FluentForm < 4.3.13 - CSV Injection
description: The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
problem types: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
affected:
{
vendor: Unknown
product: Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms
versions:
version: 4.3.13, status: affected, lessThan: 4.3.13, versionType: custom
}