Description

WordPress Plugin WP Review Slider is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin WP Review Slider version 10.9 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 11.0 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:E0402753-3A80-455B-9FAB-A7D2A7687193

https://plugins.svn.wordpress.org/wp-facebook-reviews/trunk/README.txt

Related Vulnerabilities

WordPress Plugin Advanced Post Type Ratings Cross-Site Scripting (1.01)

WordPress Plugin Video Embed & Thumbnail Generator 'kg_callffmpeg.php' Multiple Remote Code Execution Vulnerabilities (1.1)

Ramda Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Vulnerability (CVE-2021-42581)

WordPress Plugin Advanced Forms for ACF Pro Security Bypass (1.6.8)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-4278)

Severity

High

Classification

CVE-2022-0383 CWE-89 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection