WordPress Plugin Vulnerabilities

Advance Post Prefix <= 1.1.1 - Admin+ SQL Injection

Description

The plugin does not sanitize and escape a parameter before using it in a SQL statement, allowing admins and above to perform SQL injection attacks

Proof of Concept

Affects Plugins

Plugin icon
advance-post-prefix
No known fix

References

CVE
CVE-2024-12735

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
Bob Matyas
Submitter
Bob Matyas
Submitter website
https://www.bobmatyas.com
Submitter twitter
bobmatyas
Verified
Yes
WPVDB ID
1b355399-e92b-46aa-ada1-95e99fc03976

Timeline

Publicly Published
2024-11-20 (about 1 year ago)
Added
2025-01-09 (about 1 year ago)
Last Updated
2025-01-09 (about 1 year ago)

Other

Published
Title
Published
2006-09-17
Title
Subscribe to Comments < 2.0.8 - Reflected XSS
Published
2025-09-22
Title
Append extensions on Pages <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2017-03-06
Title
WordPress 3.6.0-4.7.2 - Authenticated Cross-Site Scripting (XSS) via Media File Metadata
Published
2015-08-21
Title
SEO Redirection < 2.9 - Authenticated Reflected Cross-Site Scripting (XSS)
Published
2025-08-14
Title
Real Estate Manager Pro < 12.7.4 - Reflected Cross-Site Scripting