CVE-2023-0098
Simple URLs < 115 - Subscriber+ SQLi
- State
- Published
- Severity
- 7.7 High
- Published
- Feb 13, 2023
- Updated
- Mar 21, 2025
- Reserved
- Jan 6, 2023
Description
The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Simple URLsUnknown |
|
References
- https://wpscan.com/vulnerability/db0b3275-40df-404e-aa8d-53558f0122d8exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.