CVE-2018-3810

CVE-2018-3810 covers the Oturia WordPress Smart Google Code Inserter plugin before 3.5. An authentication bypass allows unauthenticated users to update the sgcgoogleanalytic parameter, causing arbitrary JavaScript/HTML to run on all WordPress pages via saveGoogleCode() which does not verify autho...

CVE-2018-3811

The information set confirms CVE-2018-3811 affects the WordPress Oturia Smart Google Code Inserter plugin prior to v3.5. The root cause is an SQL Injection in saveGoogleAdWords() where $_POST["oId"] is unsafely interpolated into an SQL query without prepared statements or input sanitization, allo...