{"cve":"CVE-2020-7947","nvd":{"published":"2020-04-01T13:15:15.320","modified":"2026-06-17T03:25:40.627","status":"Modified","description":"An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-1236"],"references":["https://auth0.com/docs/cms/wordpress","https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0","https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6v","https://wordpress.org/plugins/auth0/#developers","https://auth0.com/docs/cms/wordpress"],"products":["auth0:login_by_auth0"],"source":"nvd","synced_at":"2026-10-19T21:03:08.679916934+00:00"},"epss":{"cve":"CVE-2020-7947","score":0.02842,"percentile":0.86675,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}