CVE-2023-5412

HIGH

Image horizontal reel scroll slideshow < 13.3 - Authenticated SQL Injection via Shortcode Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-5412. PoCs published by RandomRobbieBF.

AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2023-5412, an authenticated SQL injection vulnerability in the Image horizontal reel scroll slideshow WordPress plugin. The PoC demonstrates SQL injection via a shortcode parameter, with sqlmap payloads for boolean-based blind, error-based, time-based blind, and UNION query attacks.

Description

The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Exploits (1)

nomisec WORKING POC 5 stars
by RandomRobbieBF · poc
https://github.com/RandomRobbieBF/CVE-2023-5412

This repository contains a proof-of-concept for CVE-2023-5412, an authenticated SQL injection vulnerability in the Image horizontal reel scroll slideshow WordPress plugin. The PoC demonstrates SQL injection via a shortcode parameter, with sqlmap payloads for boolean-based blind, error-based, time-based blind, and UNION query attacks.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Image horizontal reel scroll slideshow <= 13.2
Auth required
Prerequisites: WordPress site with vulnerable plugin installed · Subscriber+ level authentication
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 8.8
EPSS 0.0149
EPSS Percentile 70.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (2)
gopiplus/Image horizontal reel scroll slideshow < 13.2
gopiplus/image_horizontal_reel_scroll_slideshow < 13.3
Published Oct 31, 2023
Tracked Since Feb 18, 2026