CVE-2021-24959CWE-89

WP Email Users <= 1.7.6 - Subscriber+ SQL Injection

published March 14, 2022

CVSS
—
EPSS
2%
Percentile
82.8
In the wild
Unconfirmed
What it is

The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02249 · 82.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-03-14T14:41Z
EPSS history
Timeline
  • 14 MAR 14:41Z
    WP Email Users <= 1.7.6 - Subscriber+ SQL Injection
    cvelistv5