CVE-2023-0381 GigPress <= 2.3.28 - Subscriber+ SQLi

2023-02-2715:24:32

WPScan

www.cve.org

sql injection

gigpress

wordpress

0.001 Low

EPSS

Percentile

31.2%

JSON

The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "GigPress",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "2.3.28"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/39c964fa-6d8d-404d-ac38-72f6f88d203c

0.001 Low

EPSS

Percentile

31.2%

JSON

Related for CVELIST:CVE-2023-0381