nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-25746 CVE-2019-25746
HIGH
WordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter
Record summary
CVE-2019-25746 has a selected CVSS score of 7.1 (high); EIP currently links 1 catalogued exploit.
Description
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 15, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Sliced InvoicesBrowse SlicedInvoices / Sliced Invoices | CVE List | 3.8.2 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBWordPress Plugin Sliced Invoices 3.8.2 - 'post' SQL InjectionExploitDB exploitby Lucian Ioan NitescuNot analyzed1 file
References
5Official Product Homepageproduct
https://slicedinvoices.com/ Product Referenceproduct
https://wordpress.org/plugins/sliced-invoices ExploitDB-47540exploit
https://www.exploit-db.com/exploits/47540 VulnCheck Advisory: WordPress Sliced Invoices 3.8.2 SQL Injection via post ParameterThird-party advisory
https://www.vulncheck.com/advisories/wordpress-sliced-invoices-sql-injection-via-post-parameter