CVE-2021-24460

The getfblikeboxes function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

Sql injection

The getfblikeboxes function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24460

The CVE-2021-24460 entry maps to a SQL injection in the WordPress Popup Like box – Page Plugin before 3.5.3. Root cause: get_fb_likeboxes() uses an unsafely constructed orderby parameter in SQL via get_results(), with no whitelist/validation. Impact: authenticated blind SQL injection reported aff...