CVE-2022-3574

CRITICAL 9.8CVE-2022-3574 · Published 14/11/2022 · updated 17/06/2026

In short

CVE-2022-3574 is a CRITICAL (CVSS 9.8) vulnerability affecting wpforms pro (wpforms).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 73.2% of all vulnerabilities.
Fix: update to 1.7.7 or later.

Package	Affected versions	Patched versions
wpforms pro wpforms	`< 1.7.7`	`1.7.7`

The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.