CVE-2021-24669: Improper Neutralization of Special Elements used in an SQL Command

The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loaderid parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection...

PT-2021-16180

Name of the Vulnerable Software and Affected Versions MAZ Loader – Preloader Builder for WordPress plugin versions prior to 1.3.3 Description The issue concerns the MAZ Loader – Preloader Builder for WordPress plugin, where the loader id parameter of the mzldr shortcode is not properly validated ...

WordPress SQL injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The WordPress plugin is a WordPress open source application plugin. The WordPress plugin is vulnerable to SQL injection, which stems from the fact that The MAZ Loader plugin does not validate or...

WordPress MAZ Loader plugin <= 1.4.0 - Arbitrary Loader Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Loader Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by apple502j in WordPress MAZ Loader plugin versions = 1.4.0. Solution Update the WordPress MAZ Loader plugin to the latest available version at least 1.4.1...

MAZ Loader < 1.4.1 - Arbitrary Loader Deletion via CSRF

The plugin does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack The vendor has been notified on August 24th, 2021, as well as escalated to the WP plugins team 3 times, no fix was made despite two new versions being released...

MAZ Loader < 1.4.1 - Arbitrary Loader Deletion via CSRF

The plugin does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack The vendor has been notified on August 24th, 2021, as well as escalated to the WP plugins team 3 times, no fix was made despite two new versions being released. PoC...

MAZ Loader < 1.3.3 - Contributor+ SQL Injection

The plugin does not validate or escape the loaderid parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection. As a user with a role as low as Contributor, put the following shortcode in a page/post and view/preview it to get the login...

MAZ Loader < 1.3.3 - Contributor+ SQL Injection

The plugin does not validate or escape the loaderid parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection. PoC As a user with a role as low as Contributor, put the following shortcode in a page/post and view/preview it to get the login...

WordPress MAZ Loader plugin <= 1.3.2 - SQL Injection (SQLi) vulnerabilities

SQL Injection SQLi vulnerabilities discovered by apple502j in WordPress MAZ Loader plugin versions = 1.3.2. Solution Update the WordPress MAZ Loader plugin to the latest available version at least 1.3.3...