Description (CNA)
The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / MAZ Loader – Preloader Builder for WordPress | affected 1.3.3 before 1.3.3 |
CWE
CWE-89
References
ADP enrichment
No English description supplied.