WP Manifestindependent plugin directory
manifest / developer / cbxphpspreadsheet

CBX PhpSpreadSheet Library WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

PHP Spreadsheet library as WordPress plugin

★ 13stars
3.8krelease downloads
≈50active sites
1.0.12latest · 1 year ago

Install

Download cbxphpspreadsheet.zip From the 1.0.12 release on GitHub, Apr 15, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/codeboxrcodehub/cbxphpspreadsheet/releases/download/1.0.12/cbxphpspreadsheet.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

Open source PhpSpreadSheet php library released as wordpress plugin to use easily

Description

A pure PHP library for reading and writing spreadsheet files

From Codeboxr we wrapped the library as wordpress plugin to easy distribute as wordpress plugin. WordPress now doesn't allow this type library as plugin but providing a large php package with plugin makes the plugin heavy and troublesome for updates. We hosted this in github so that user can download and later update easily.

Software requirements

The following software is required to develop using PhpSpreadsheet:

  • PHP version 8.1 or newer
  • PHP extension php_zip enabled
  • PHP extension php_xml enabled
  • PHP extension php_gd2 enabled (if not compiled in)

The plugin check php version, php_zip, php_xml and php_gd2 library compatible or installed or not, based on success it activated.

How to use:

` if ( function_exists( 'cbxphpspreadsheet_loadable' ) && cbxphpspreadsheet_loadable() ) {

//Include PHPExcel
require_once( CBXPHPSPREADSHEET_ROOT_PATH . 'lib/vendor/autoload.php' ); //or use 'cbxphpspreadsheet_load();'

//now take instance
$objPHPExcel = new \PhpOffice\PhpSpreadsheet\Spreadsheet();

//do whatever you need to do

} `

Installation

  1. Download the latest zip from here (https://github.com/codeboxrcodehub/cbxphpspreadsheet/releases)
  2. [WordPress has clear documentation about how to install a plugin].(https://codex.wordpress.org/Managing_Plugins)
  3. After install activate the plugin "CBX PhpSpreadSheet Library" through the 'Plugins' menu in WordPress
  4. This plugin doesn't load any library by default, it doesn't create extra folder or menu.

Changelog

1.0.12

  • [updated] Plugin's important link/help url display improved

1.0.11

  • [updated] Added plugin update checker

1.0.10

  • Updated php package phpoffice/phpspreadsheet to 3.9.1

1.0.9

  • Fixed function 'php_version_check'

1.0.8

  • Dependency vendor packages updated to latest
  • Added some helper functions for better environment checking

Releases

11 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.0.12 latest
Apr 15, 2025 1 year ago
cbxphpspreadsheet.zip
732
Apr 15, 2025 1 year ago
cbxphpspreadsheet.zip
12
Mar 19, 2025 1 year ago
cbxphpspreadsheet.zip
49
Jan 22, 2025 1 year ago
cbxphpspreadsheet.zip
89
Jan 20, 2025 1 year ago
cbxphpspreadsheet.zip
17
Oct 3, 2024 2 years ago
cbxphpspreadsheet.zip
164
Mar 13, 2024 2 years ago
cbxphpspreadsheet.zip
260
Jan 30, 2024 2 years ago
cbxphpspreadsheet.zip
90
Sep 23, 2022 4 years ago
cbxphpspreadsheet.zip
659
Jan 30, 2022 4 years ago
cbxphpspreadsheet.zip
591
May 25, 2019 7 years ago
cbxphpspreadsheet.zip
1,146

Active-site estimate ≈50 comes from the median of recent superseded releases. Method.

C- grade

Security

CBX PhpSpreadSheet Library 1.0.12 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.12
Findings
1
Worst severity
high
Content hash
391a3e60bd416935cddb741c…

Findings

  • high Bundled PhpSpreadsheet 3.9.1 is affected by public SSRF/RCE, DoS, and XSS CVEs

    outdated_software

    The plugin's product is a Composer-vendored copy of phpoffice/phpspreadsheet 3.9.1 (lock reference 56f334ace62fc8301c98d425272cbf0a00eb848d). Plugin-owned code never parses a request; it only defines cbxphpspreadsheet_load() which require_once's lib/vendor/autoload.php so other WordPress plugins can new Spreadsheet() / IOFactory::load(). That 3.9.1 tree is still vulnerable to multiple patched advisories: CVE-2026-34084 (File::assertFile trusts PHP is_file() on wrapper-aware paths, so a user-controlled filename such as phar:// or ftp:// yields SSRF and, on PHP 7.x gadget chains, RCE; 3.9.1 has no File::prohibitWrappers), CVE-2025-54370 (Worksheet\Drawing::setPath file_get_contents()s attacker URLs when an HTML/spreadsheet image path is a URL), CVE-2026-40902 (XLSX row attribute r is cast to int with no 1,048,576 cap, so a tiny crafted workbook forces ~1e9 loop iterations), and CVE-2026-40296 (HTML writer XSS via number-format @ placeholder). Later 3.10.x/5.x releases patched these; this GitHub plugin last shipped 3.9.1 in 1.0.10 (March 2025) and has had no library bump since. Sites install this plugin specifically so a consumer can parse uploads — treat the shared copy as the production parser and upgrade it.

    lib/vendor/phpoffice/phpspreadsheet/src/PhpSpreadsheet/Shared/File.php:144-164

    Recommendation

    Bump phpoffice/phpspreadsheet to a patched 3.10.5+ on the 3.x line (or current 5.x if a major bump is acceptable), regenerate lib/vendor, and drop vendor test/example/buildPhar.php files from the WordPress zip. Do not load user-controlled paths into IOFactory::load(); pass only WordPress-managed upload tmp names after verifying they are local files.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.