CVE-2022-1688

LOW

Note Press WordPress Plugin <= 0.1.10 - Authenticated SQL Injection via ID Parameter

Title source: llm
STIX 2.1

Description

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/63d4444b-9b04-47f5-a692-c6c6c8ea7d92
Exploit, Third Party Advisory x_refsource_misc
https://bulletin.iese.de/post/note-press_0-1-10_1

Scores

CVSS v3 2.7
EPSS 0.0076
EPSS Percentile 51.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-89
Status published
Products (1)
datainterlock/note_press < 0.1.10
Published Jun 08, 2022
Tracked Since Feb 18, 2026