Description

WordPress Plugin WP RSS By Publishers is prone to multiple SQL injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin WP RSS By Publishers version 0.1 is vulnerable.

Remediation

Disable and remove the plugin until a fix is available

References

https://bulletin.iese.de/post/wp-rss-by-publishers_0-1_1/

https://bulletin.iese.de/post/wp-rss-by-publishers_0-1_2/

https://bulletin.iese.de/post/wp-rss-by-publishers_0-1_3/

https://wordpress.org/plugins/wp-rss-by-publishers/#description

Related Vulnerabilities

MySQL CVE-2020-2572 Vulnerability (CVE-2020-2572)

Joomla! Core 1.5.x Security Bypass (1.5.0 - 1.5.25)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-23796)

Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-7886)

Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-5494)

Severity

High

Classification

CVE-2022-4358 CVE-2022-4359 CVE-2022-4360 CWE-89 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection