Description
WordPress Plugin Ultimate SMS Notifications for WooCommerce is prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files. Attackers can possibly exploit this issue to execute arbitrary commands on the victim's system, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks. WordPress Plugin Ultimate SMS Notifications for WooCommerce version 1.4.1 is vulnerable; prior versions are also affected.
Remediation
Update to plugin version 1.4.2 or latest
References
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2429
https://plugins.svn.wordpress.org/ultimate-sms-notifications/trunk/README.txt
Related Vulnerabilities
WordPress Plugin Count per Day Information Disclosure (3.2.5)
WordPress Plugin You Shang Cross-Site Scripting (1.0.1)
Oracle Database Server CVE-2020-2515 Vulnerability (CVE-2020-2515)
MySQL CVE-2023-21950 Vulnerability (CVE-2023-21950)
WordPress Plugin Real Estate Website Builder 'ajax_action' Parameter Cross-Site Scripting (0.1.0)