Description phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports. Remediation References CVE-2021-3188 Related Vulnerabilities WordPress Plugin MiniCart SQL Injection (1.00.1) WordPress Plugin Advanced Page Manager Cross-Site Scripting (1.4.1) Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-26079) WordPress 5.8.x Multiple Vulnerabilities (5.8 - 5.8.4) WordPress Plugin WP People 'wp-people-popup.php' SQL Injection (2.0) Severity Critical Classification CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Tags Missing Update Known Vulnerabilities CWE-1236 CVE-2021-3188