CVE-2025-28982: WordPress WP Pipes plugin <= 1.4.3

Record summary

CVE-2025-28982 has a selected CVSS score of 9.3 (critical).

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes allows SQL Injection. This issue affects WP Pipes: from n/a through 1.4.3.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableYes

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 16, 2025 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
WP Pipes Browse ThimPress / WP Pipes Default status: unaffected	CVE List	Through 1.4.3	affected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2025-28982

patchstack.comvdb entry

https://patchstack.com/database/wordpress/plugin/wp-pipes/vulnerability/wordpress-wp-pipes-1-4-3-sql-injection-vulnerability?_s_id=cve