The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
CWE-1236