Threats tagged 'ghsa-fq97-377j-862h'

The Community Events plugin for WordPress up to version 1.5.4 is vulnerable to SQL Injection via the 'dayofyear' parameter. This vulnerability arises from insufficient escaping and lack of proper preparation of the SQL query, allowing unauthenticated attackers to inject additional SQL commands. Exploitation can lead to unauthorized extraction of sensitive database information. The vulnerability has a high severity score of 7.5 and does not require user interaction or privileges to exploit.