Description (CNA)
The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as low as editor, leading to an authenticated SQL Injection
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Unlimited PopUps | affected 4.5.3 through 4.5.3 |
CWE
CWE-89
References
- https://wpscan.com/vulnerability/9841176d-1d37-4636-9144-0ca42b6f3605
- https://codevigilant.com/disclosure/2021/wp-plugin-unlimited-popups/
ADP enrichment
No English description supplied.