CVE-2022-0434

CRITICAL EXPLOITED NUCLEI

WordPress Plugin <2.4.15 - SQL Injection

Title source: llm

Description

The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks

Nuclei Templates (1)

WordPress Page Views Count <2.4.15 - SQL Injection

CRITICALVERIFIEDby theamanrawat

References (1)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/be895016-7365-4ce4-a54f-f36d0ef2d6f1

Scores

CVSS v3 9.8

EPSS 0.8771

EPSS Percentile 99.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2025-06-07

CWE

CWE-89

Status published

Products (1)

a3rev/page_view_count < 2.4.15

Published Mar 07, 2022

Tracked Since Feb 18, 2026