WordPress Plugin Vulnerabilities

Post Grid < 2.1.13 - Contributor+ SQL Injection

Description

The plugin does not sanitise and escape user input before using it in a SQL statement when duplicating posts (available to Contributor+ users), leading to an SQL Injection

Affects Plugins

Plugin icon
post-grid
Fixed in 2.1.13

References

URL
https://plugins.trac.wordpress.org/changeset/2644269

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
6.8 (medium)

Miscellaneous

Verified
Yes
WPVDB ID
ecf04da1-09a8-456d-a0cb-6db0a02cb704

Timeline

Publicly Published
2021-12-15 (about 4 years ago)
Added
2021-12-24 (about 4 years ago)
Last Updated
2021-12-24 (about 4 years ago)

Other

Published
Title
Published
2014-08-01
Title
WordPress <= 1.5.1.1 - SQL Injection
Published
2025-10-02
Title
Wp cycle text announcement <= 8.1 - Authenticated (Contributor+) SQL Injection
Published
2012-01-20
Title
Mingle Forum < 1.0.33 - Multiple SQL Injection
Published
2024-11-08
Title
L Squared Hub WP <= 1.0 - Authenticated (Contributor+) SQL Injection
Published
2025-03-21
Title
ProfileGrid – User Profiles, Groups and Communities < 5.9.4.8 - Authenticated (Subscriber+) SQL Injection