The Export Users to CSV plugin up to and including 1.1.1 for WordPress allows CSV injection.
export users to csv project export users to csv