CVE-2022-1684

LOW

Cube Slider < 1.2 - Authenticated SQL Injection via idslider Parameter

Title source: llm
STIX 2.1

Description

The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/db7fb815-945a-41c7-8932-834cc646a806
Exploit, Third Party Advisory x_refsource_misc
https://bulletin.iese.de/post/cube-slider_1-2

Scores

CVSS v3 2.7
EPSS 0.0076
EPSS Percentile 51.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-89
Status published
Products (1)
webpsilon/cube_slider < 1.2
Published Jun 08, 2022
Tracked Since Feb 18, 2026