CVE-2022-2429

The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into billing information like their First Name that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

• CWE-138
• CWE-1236

• https://plugins.trac.wordpress.org/browser/ultimate-sms-notifications/trunk/README.txt?rev=2441845#L92Release Notes, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2429Third Party Advisory
• https://plugins.trac.wordpress.org/browser/ultimate-sms-notifications/trunk/README.txt?rev=2441845#L92Release Notes, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2429Third Party Advisory

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24282A vulnerability has been identified in SINEC NMS (All versio…7.2
• CVE-2022-24285Acer Care Center 4.00.30xx before 4.00.3042 contains a local…7.8
• CVE-2022-24286Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx be…7.8
• CVE-2022-24287A vulnerability has been identified in SIMATIC PCS 7 V8.2 (A…7.8
• CVE-2022-24288In Apache Airflow, prior to version 2.2.4, some example DAGs…8.8
• CVE-2022-24289Hessian serialization is a network protocol that supports ob…8.8
• CVE-2022-24290A vulnerability has been identified in Teamcenter V12.4 (All…7.5
• CVE-2022-24291Certain HP Print devices may be vulnerable to potential info…7.5
• CVE-2022-24292Certain HP Print devices may be vulnerable to potential info…9.8
• CVE-2022-24293Certain HP Print devices may be vulnerable to potential info…9.8
• CVE-2022-24294A regular expression used in Apache MXNet (incubating) is vu…7.5
• CVE-2022-24295Okta Advanced Server Access Client for Windows prior to vers…8.8