Description (CNA)
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Slider Hero with Animation, Video Background & Intro Maker | affected 8.2.7 before 8.2.7 |
CWE
CWE-89
References
ADP enrichment
No English description supplied.