CVE-2023-0329

Elementor Website Builder < 3.12.2 - Admin+ SQLi

High · published May 30, 2023

CVSS v3.1
7.2
EPSS
20%
Percentile
97.4
In the wild
Unconfirmed
What it is

The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.19695 · 97.4th percentile
Published
2023-05-30T07:49Z
EPSS history
Timeline
  • 30 MAY 07:49Z
    Elementor Website Builder < 3.12.2 - Admin+ SQLi
    cvelistv5