CVE-2023-5437: Improper Neutralization of Special Elements used in an SQL Command

The WP fade in text news plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-5431: Improper Neutralization of Special Elements used in an SQL Command

The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2023-5439: Improper Neutralization of Special Elements used in an SQL Command

The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-5435: Improper Neutralization of Special Elements used in an SQL Command

The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

CVE-2023-5430: Improper Neutralization of Special Elements used in an SQL Command

The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2023-32107

Name of the Vulnerable Software and Affected Versions wp image slideshow plugin for WordPress versions up to, and including, 12.0 Description The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query, allowing...

PT-2023-32104

Name of the Vulnerable Software and Affected Versions Up down image slideshow gallery plugin for WordPress versions up to, and including, 12.0 Description The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the...

PT-2023-32108

Name of the Vulnerable Software and Affected Versions Wp photo text slider 50 plugin for WordPress versions up to, and including, 8.0 Description The issue allows authenticated attackers with subscriber-level and above permissions to perform SQL Injection via the plugin's shortcode due to...

PT-2023-7558

Name of the Vulnerable Software and Affected Versions Image Horizontal Reel Scroll Slideshow Plugin versions up to, and including, 13.2 Description The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the plugin...

PT-2023-32119

Name of the Vulnerable Software and Affected Versions Jquery accordion slideshow plugin for WordPress versions up to, and including, 8.1 Description The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query, allowing...

CVE-2023-5434: Improper Neutralization of Special Elements used in an SQL Command

The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-5412: Improper Neutralization of Special Elements used in an SQL Command

The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2023-5429: Improper Neutralization of Special Elements used in an SQL Command

The Information Reel plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-5464: Improper Neutralization of Special Elements used in an SQL Command

The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-5250

The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.2 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those file...

CVE-2023-5199

The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute cod...

Sql injection

The Google Maps made Simple plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-5315 Google Maps made Simple <= 0.6 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Google Maps made Simple plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-5250: Improper Control of Filename for Include/Require Statement in PHP Program

The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.3 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those file...

CVE-2023-5199: Improper Control of Filename for Include/Require Statement in PHP Program

The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute cod...