4 matches found
CVE-2025-11501
CVE-2025-11501: The WordPress plugin Dynamically Display Posts is vulnerable to SQL Injection via tax_query in all versions up to 1.1 due to insufficient escaping and lack of prepared statements. This allows unauthenticated attackers to append additional SQL to existing queries, enabling potentia...
CVE-2025-11501 Dynamically Display Posts <= 1.1 - Unauthenticated SQL Injection
The Dynamically Display Posts plugin for WordPress is vulnerable to SQL Injection via the 'taxquery' parameter in all versions up to, and including, 1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
Remote code execution
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the taxquery, metaquery, or datequery parameter in mlagallery via an admin...
