CVE-2024-5325

The Form Vibes plugin for WordPress is vulnerable to SQL Injection via the ‘fvexportdata’ parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

WordPress Form Vibes plugin <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data vulnerability

Authenticated Subscriber+ SQL Injection via fvexportdata vulnerability discovered by Peter Thaleikis in WordPress Plugin Form Vibes – Database Manager for Forms versions = 1.4.10...