CVE-2024-3265

WP Advanced Search <= 1.1.6 - Admin+ SQL Injection

Medium · published April 25, 2024

CVSS v3.1
4.7
EPSS
0%
Percentile
35.4
In the wild
Unconfirmed
What it is

The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00422 · 35.4th percentile
Published
2024-04-25T21:25Z
EPSS history
Timeline
  • 25 APR 21:25Z
    WP Advanced Search <= 1.1.6 - Admin+ SQL Injection
    cvelistv5