CVE-2025-9462

The WP2LEADS plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 3.5.6 . The root cause is insufficient escaping of the user-supplied 'order' parameter and a lack of sufficient preparation in the existing SQL query. This vulnerability allows authen...