CVE-2019-11872

The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the plugin does not sanitize the user's input and allows insertion of any text.

• CWE-1236

• https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin/Broken Link, Exploit, Third Party Advisory
• https://blog.reddy.io/category/cybersecurity/Broken Link, Exploit, Third Party Advisory
• https://wordpress.org/plugins/wordpress-popup/#developersRelease Notes
• https://wpvulndb.com/vulnerabilities/9326Third Party Advisory
• https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin/Broken Link, Exploit, Third Party Advisory
• https://blog.reddy.io/category/cybersecurity/Broken Link, Exploit, Third Party Advisory
• https://wordpress.org/plugins/wordpress-popup/#developersRelease Notes
• https://wpvulndb.com/vulnerabilities/9326Third Party Advisory

Published

May 29, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11867Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015…5.5
• CVE-2019-11868See.sys, up to version 4.25, in SoftEther VPN Server version…7.8
• CVE-2019-11869The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS …
• CVE-2019-1187A denial of service vulnerability exists when the XmlLite ru…5.5
• CVE-2019-11870Serendipity before 2.1.5 has XSS via EXIF data that is misha…
• CVE-2019-11871The Custom Field Suite plugin before 2.5.15 for WordPress ha…
• CVE-2019-11873wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tl…9.8
• CVE-2019-11875In AutomateAppCore.dll in Blue Prism Robotic Process Automat…
• CVE-2019-11876In PrestaShop 1.7.5.2, the shop_country parameter in the ins…
• CVE-2019-11877XSS on the PIX-Link Repeater/Router LV-WR09 with firmware v2…
• CVE-2019-11878An issue was discovered on XiongMai Besder IP20H1 V4.02.R12.…
• CVE-2019-11879The WEBrick gem 1.4.2 for Ruby allows directory traversal if…