Threats tagged 'ghsa-977q-pq7w-wxx3'

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress versions up to and including 8.8 contains an SQL Injection vulnerability via the 'from' and related shortcode attributes in the [wsm_showTrafficStatsList] shortcode. This vulnerability arises from insufficient sanitization of user-supplied shortcode attributes, allowing authenticated users with Contributor-level access or higher to inject malicious SQL queries. The flaw enables attackers to extract sensitive database information without requiring UI interaction.