CVE-2021-25109 Futurio Extra < 1.6.3 - Authenticated SQL Injection

2022-02-1409:20:52

CWE-89

WPScan

www.cve.org

4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.8%

JSON

The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.

CNA Affected

[
  {
    "product": "Futurio Extra",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.6.3",
        "status": "affected",
        "version": "1.6.3",
        "versionType": "custom"
      }
    ]
  }
]