Threats tagged 'ghsa-8w5g-8jf5-frvg'

A SQL injection vulnerability exists in the wp-review-slider-pro WordPress plugin versions before 12.7.12. The flaw arises because an AJAX handler does not sanitize input and lacks a capability check, allowing any authenticated user, including low-privileged roles like subscribers, to inject SQL commands. The results of these injections can be returned to unauthenticated visitors. This vulnerability has a CVSS score of 6.5, indicating a medium severity risk.