WordPress Plugin Vulnerabilities

WP Custom Cursors < 3.2 - Admin+ SQLi

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.

Proof of Concept

Affects Plugins

Plugin icon
wp-custom-cursors
Fixed in 3.2

References

CVE
CVE-2023-2221

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
Chien Vuong
Submitter
Chien Vuong
Verified
Yes
WPVDB ID
6666688e-7239-4d40-a348-307cf8f3b657

Timeline

Publicly Published
2023-05-24 (about 2 years ago)
Added
2023-05-24 (about 2 years ago)
Last Updated
2023-05-24 (about 2 years ago)

Other

Published
Title
Published
2025-08-15
Title
tPlayer <= 1.2.1.6 - Unauthenticated SQL Injection
Published
2022-02-11
Title
Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection
Published
2015-12-17
Title
Welcart e-Commerce < 1.5.3 - SQL Injection
Published
2022-12-09
Title
LetsRecover < 1.2.0 - Admin+ SQLi
Published
2021-02-08
Title
Welcart e-Commerce < 2.1.1 - Authenticated SQL Injection