Threats tagged 'ghsa-rq3c-qcg6-jg99'

The Quick Featured Images WordPress plugin contains an SQL Injection vulnerability in the 'delete_orphaned' function affecting all versions up to and including 13.7.3. This flaw allows authenticated users with Editor-level or higher privileges to inject additional SQL queries via insufficiently escaped user input, potentially exposing sensitive database information if a higher-privileged user adds a malicious custom field value.