SQL Injection Vulnerability in Video Carousel Slider with Lightbox Plugin for WordPress

CVE-2019-25212

Summary

The WP Responsive Video Gallery with Lightbox plugin for WordPress is susceptible to SQL Injection via the 'id' parameter, affecting all versions up to and including 1.0.6. This vulnerability arises from inadequate escaping of user-supplied data and insufficient preparation of SQL queries. Authenticated users with administrator-level access or higher can exploit this flaw to insert additional SQL queries into existing ones. This exploitation can lead to unauthorized extraction of sensitive information from the database, posing significant risks to the integrity and confidentiality of user data.

References