Globalbpa

**Name of the Vulnerable Software and Affected Versions** TablePress plugin version 1.9.2 **Description** The issue allows `tablepress[data]` CSV injection by Editor users. This could potentially lead to malicious actions when the CSV file is opened by an application. Note that the vendor disputes this issue, arguing that the responsibility lies with the application that opens the CSV file, not TablePress. **Recommendations** For TablePress plugin version 1.9.2, consider restricting Editor user access to mitigate the risk of CSV injection until a resolution is provided by the vendor. At the moment, there is no information about a newer version that contains a fix for this vulnerability.