CVE-2023-5424 is a medium severity (CVSS 4.7) CSV injection in the WS Form LITE WordPress plugin, versions up to and including 1.9.217. Unauthenticated users can embed untrusted input in exported CSV files. Update to a release after 1.9.217 and open exports with care.
What's affected
The NVD record says WS Form LITE is vulnerable to CSV injection in versions up to and including 1.9.217. Unauthenticated attackers can embed untrusted input into exported CSV files, which can result in code execution when the files are downloaded and opened on a local system with a vulnerable configuration.
The record links the plugin changeset, the vendor changelog and a Wordfence entry. The changelog page we read lists only recent releases, and the Wordfence page could not be retrieved, so we cannot state the exact first fixed release. Anything after 1.9.217 is outside the affected range in the record. Check the plugin changelog for the entry that mentions the fix.
Note who the victim is. The web server is not harmed by the stored text. The risk lands on whoever opens the exported file in a spreadsheet program.
How to check if you're exposed
Read the installed version with WP-CLI or the Plugins page.
wp plugin list --format=table
Look for the WS Form entry, and make sure the version is above 1.9.217.
Then think about who exports form submissions as CSV. Marketing, sales and support staff often download them and open them in a spreadsheet, so they are the people at risk if the form is public.
What to do now
- Update WS Form LITE to the latest release.
- Confirm in the changelog that the CSV export issue is addressed.
- Tell staff who export submissions to open files in a safe mode, and not to enable macros or external links.
- Use your spreadsheet program settings to block automatic link and command execution.
- Review recent submissions for entries that begin with unusual characters used by spreadsheet formulas.
Why it matters
The weakness is CWE-1236, improper neutralization of formula elements in a CSV file. Spreadsheet programs treat cells that start with certain characters as formulas. A form submission that starts that way becomes active content when the exported file is opened.
Because the attacker can submit a form without logging in, the data is untrusted by definition. The fix is for the plugin to neutralize such cells on export, and for users to keep their spreadsheet settings tight. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Who is at risk from CSV injection?
The person who opens the exported file. Update the plugin, and ask staff to treat exports from public forms as untrusted files.
Sources
Last reviewed: 19 October 2026.
