{“lastseen”:””,”description”:”The AnWP Football Leagues plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 0.16.17 via the ‘download_csv_players’ and ‘download_csv_games’ functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.”,”published”:”2025-08-12T06:42:40.577Z”,”modified”:”2025-08-12T06:42:40.577Z”,”type”:”cve”,”title”:”AnWP Football Leagues \\u003c= 0.16.17 – Authenticated (Administrator+) CSV Injection”,”source”:”Wordfence”,”references”:”https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/04676263-cdad-40cd-bb54-61beb727e09d?source=cve\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/football-leagues-by-anwppro\/trunk\/includes\/class-anwpfl-data-port.php#L93\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/football-leagues-by-anwppro\/trunk\/includes\/class-anwpfl-data-port.php#L265\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/football-leagues-by-anwppro\/trunk\/includes\/class-anwpfl-data-port.php#L58\\nhttp:\/\/plugins.trac.wordpress.org\/changeset\/3342787\/football-leagues-by-anwppro\/trunk\/includes\/class-anwpfl-data-port.php”,”id”:”CVE-2025-8767″,”bulletinFamily”:””,”cwe”:[“CWE-1236″],”cvelist”:null,”sourceData”:”anwppro AnWP Football Leagues *”,”sourceHref”:””,”cvss”:{“score”:4.8,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”AnWP Football Leagues”,”version”:”*”,”vendor”:”anwppro”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”The AnWP Football Leagues plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 0.16.17 via the ‘download_csv_players’ and ‘download_csv_games’…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,75,12,21,13,7,11,5],"class_list":["post-10465","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-48","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n