Sql injection

The Orders functionality in the WordPress Page Contact plugin through 1.0 has an orderid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors...

Sql injection

The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an orderid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors...

CVE-2021-24402 WP iCommerce <= 1.1.1 - Authenticated (contributor+) SQL Injection

The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an orderid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors...

PT-2021-15936

Name of the Vulnerable Software and Affected Versions WordPress Page Contact plugin versions prior to 1.1 Description The Orders functionality in the WordPress Page Contact plugin has an issue where the order id parameter is not properly sanitized, escaped, or validated before being inserted into...

PT-2021-15935

Name of the Vulnerable Software and Affected Versions WP iCommerce WordPress plugin versions 1.1.1 and earlier Description The Orders functionality in the WP iCommerce WordPress plugin has an order id parameter that is not sanitized, escaped, or validated before being inserted into a SQL statemen...

WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL Injection

The Orders functionality in the plugin has an orderid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors PoC POST /wp-admin/admin.php?page=wpagecontact-plugin...