CSV to HTML
CSV to HTML has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 8.0, and the most serious one scores 9.9 out of 10. Severity breakdown: 1 critical and 0 high. 2024 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type.
Every one of the 2 issues recorded for CSV to HTML has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. CSV to HTML is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2024-52406CSV to html <= 3.26 - Authenticated (Subscriber+) Arbitrary File Upload
Read the full analysisVulnerability Records
CSV to HTML
Author
wibergsweb
CSV to HTML is a highly configurable plugin that makes it easy to fetch content from file(s) (.csv,.xlsx, .json and .ods) and put content from that file/those files and display the html(table) on a page with a single shortcode. If using more than one file, content from all files are mixed into one single table instead of creating two tables. The plugin fetches the actual content directly from the file(s) without having to import/export any file(s) manually. So any changes in the file(s) will be updated when you view your table(s). CSV to HTML is able to fetch both local and external files. Get started with the plugin by moving on to the Installation tab. There’s a 4 step guide how you could start using the plugin. Good luck!
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C