CVE-2022-1686

CVE-2022-1686 affects the WordPress Five Minute Webshop plugin (versions ≤ 1.3.2). The vulnerability arises from improper sanitisation/escaping of the id parameter when editing a product via the admin dashboard, allowing SQL Injection. Exploitation is evidenced by authenticated SQLi disclosures a...

CVE-2022-1685

The CVE-2022-1685 entry concerns the Five Minute Webshop WordPress plugin (versions up to 1.3.2). The vulnerability is an SQL injection in the admin Manage Products page caused by improper validation/sanitisation of the orderby parameter before it is used in a SQL statement. Several connected sou...