CVE-2023-5436 Vertical marquee plugin <= 7.1 - Authenticated (Subscriber+) SQL Injection via Shortcode

🗓️ 31 Oct 2023 08:32:53Reported by WordfenceType

The Vertical marquee plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2023-5436	31 Oct 202311:20	–	circl
CNNVD	WordPress Plugin Vertical marquee SQL Injection Vulnerability	31 Oct 202300:00	–	cnnvd
CVE	CVE-2023-5436	31 Oct 202308:32	–	cve
EUVD	EUVD-2023-57751	3 Oct 202520:07	–	euvd
NVD	CVE-2023-5436	31 Oct 202309:15	–	nvd
OSV	CVE-2023-5436	31 Oct 202309:15	–	osv
Patchstack	WordPress Vertical Marquee Plugin Plugin <= 7.1 is vulnerable to SQL Injection	30 Oct 202300:00	–	patchstack
Prion	Sql injection	31 Oct 202309:15	–	prion
Positive Technologies	PT-2023-32105 · WordPress · Vertical Marquee Plugin	31 Oct 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-5436	23 May 202504:31	–	redhatcve

[
  {
    "vendor": "gopiplushotmailcom",
    "product": "Vertical marquee plugin",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "7.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/vertical-marquee-plugin/trunk/vertical-marquee-plugin.php
plugins	www.plugins.trac.wordpress.org/changeset/2985561/vertical-marquee-plugin
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/cd90d9c0-0cab-4fd3-b016-106032f300f7

08 Apr 2026 17:24Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.8

EPSS0.00255

CWE-89