CSV injection occurs when websites generate CSV files and include untrusted user input within them. I'll explain why this is dangerous, and how you can protect your site against it.

This week's vulnerability news will be brief - I will highlight 3 plugins with WordPress Options Update vulnerabilities (2 of which require no authentication). Each of these plugin's authors have released a patch.

I will also highlight a plugin affected by a CSV Injection vulnerability that, unfortunately, has not yet been patched (but of course, Patchstack Pro and Business users are protected by a virtual patch).