WordPress Plugin Vulnerabilities

Slide Anything < 2.3.41 - Contributor+ SQLi

Description

The plugin does not sanitise and escape some parameters before using them in a SQL statement when duplicating Sliders, which could allow users with a role as low as Contributor to perform SQL injections

Affects Plugins

Plugin icon
slide-anything
Fixed in 2.3.41

References

URL
https://plugins.trac.wordpress.org/changeset/2690774/slide-anything

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
7.7 (high)

Miscellaneous

Verified
Yes
WPVDB ID
bbd7a9aa-a777-4752-9b39-3bf554c45cef

Timeline

Publicly Published
2022-03-08 (about 3 years ago)
Added
2022-04-11 (about 3 years ago)
Last Updated
2022-04-11 (about 3 years ago)

Other

Published
Title
Published
2016-01-27
Title
Appointment Booking Calendar < 1.1.25 - Unauthenticated SQL Injection
Published
2022-08-02
Title
Fluent Support < 1.5.8 - Admin+ SQLi
Published
2025-03-27
Title
Traveler < 3.2.1 - Unauthenticated SQL Injection
Published
2022-06-16
Title
Pricing Deals for WooCommerce < 2.0.3 - Unauthenticated SQLi
Published
2025-01-29
Title
VR-Frases (collect & share quotes) < 4.0 - Authenticated (Admin+) SQL Injection