Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1

Export CSV
CVE-2021-24403

WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL Injection

The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Wpagecontact Project
Products
Wpagecontact