CVE-2023-0261

HIGHNuclei

WP TripAdvisor Review Slider < 10.8 - Subscriber+ SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-0261 has a selected CVSS score of 8.8 (high); EIP currently links 1 Nuclei template.

Description

The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 21, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP TripAdvisor Review Slider

Default status: unaffected

CVE ListBefore 10.8affected

Nuclei templates

1
ProjectDiscoveryHIGHWordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL InjectionCVSS 8.8

WordPress WP TripAdvisor Review Slider plugin before 10.8 is susceptible to authenticated SQL injection. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. This can lead, in turn, to obtaining sensitive information, modifying data, and/or executing unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary SQL queries on the WordPress database, potentially leading to unauthorized access, data manipulation, or privilege escalation.

Remediation

Fixed in version 10.8.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicve2023cvewordpresswpwp-tripadvisor-review-sliderauthsqliwp-pluginwpscanljappsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:ljapps:wp_tripadvisor_review_slider:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/6a3b6752-8d72-4ab4-9d49-b722a947d2b0 https://wordpress.org/plugins/wp-tripadvisor-review-slider/ https://nvd.nist.gov/vuln/detail/CVE-2023-0261 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2