This vulnerability involves improper neutralization of special elements used in SQL commands within the WPExperts Square For GiveWP plugin. It allows an attacker with network access and low privileges to perform SQL Injection attacks, potentially leading to unauthorized disclosure of data and partial denial of service. The affected versions include all versions up to 1.3. No patch or official remediation details are currently provided.

Successful exploitation can lead to high confidentiality impact by exposing sensitive data and low availability impact by causing partial denial of service. Integrity impact is not indicated. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation in environments where the plugin is deployed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and monitor for suspicious activity related to SQL queries. Avoid exposing the plugin to untrusted networks where possible.