CVE-2021-24441: 
WordPress vulnerability analysis and mitigation

The Sign-up Sheets WordPress plugin before version 1.0.14 contains a CSV injection vulnerability (CVE-2021-24441). The vulnerability exists because the plugin does not properly sanitize or validate the Sheet title when generating CSV exports (WPScan).

The vulnerability is classified as a CSV injection issue with a CVSS score of 6.2 (medium) and is mapped to CWE-1236. When generating CSV exports, the plugin fails to properly sanitize the Sheet title field, allowing formula injection. This can be demonstrated by creating a sheet with a formula like '=1+2' as the title - when exported and opened in a spreadsheet application, the formula is executed rather than displayed as text (WPScan).

When exploited, this vulnerability could allow an authenticated attacker to inject malicious formulas into CSV exports. When these exported files are opened in spreadsheet applications, the injected formulas would be executed, potentially leading to command execution on the system opening the file (WPScan).

The vulnerability has been fixed in version 1.0.14 of the Sign-up Sheets plugin. Users should update to this version or later to mitigate the risk (WPScan).