CVE-2021-24458

The getayspopupboxes and getpopupcategories functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24458

creationtimestamp| type| source ---|---|--- 2021-08-02 14:27:32+00:00| seen| https://t.me/cibsecurity/26662...

CVE-2021-24458

CVE-2021-24458 affects WordPress Popup box plugin versions before 2.3.4. The vulnerable code paths are get_ays_popupboxes() and get_popup_categories(), which do not whitelist or validate the orderby parameter before interpolating it into SQL executed by get_results(), enabling authenticated blind...