Read the docs
TI-2023-04993 Aliases CVE-2023-5424GHSA-cqx6-vqmj-2pph

WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection

Priority LOW 39CWE-1236Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00493 42nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WS FormWS Form LITE – Drag & Drop Contact Form Builderup to 1.9.217—No fix listedCNA
WS FormWS Form Proup to 1.9.217—No fix listedCNA
  • WS Form LITE – Drag & Drop Contact Form Builder VendorWS Form Affected up to 1.9.217 Fixed in — No fix listed CNA
  • WS Form Pro VendorWS Form Affected up to 1.9.217 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:westguardsolutions:ws_form:*:*:*:*:lite:wordpress:*:*before 1.9.218VulnerableWS Form
cpe:2.3:a:westguardsolutions:ws_form:*:*:*:*:pro:wordpress:*:*before 1.9.218VulnerableWS Form
  • cpe:2.3:a:westguardsolutions:ws_form:*:*:*:*:lite:wordpress:*:* Versions before 1.9.218 Vulnerable ·WS Form
  • cpe:2.3:a:westguardsolutions:ws_form:*:*:*:*:pro:wordpress:*:* Versions before 1.9.218 Vulnerable ·WS Form

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5424
  2. 2026-10-03 Alias added: GHSA-cqx6-vqmj-2pph

References

Patch 1

Advisory 1

Other 1

  • TI-2024-12550 WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting CVSS 3.1HIGH 7.2
  • TI-2023-28574 WordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL Injection CVSS 3.1HIGH 7.6
  • TI-2022-07951 WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2024-09865 WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL CVSS 3.1MEDIUM 6.1
  • TI-2022-07950 WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences