SQL Injection Vulnerability in Horizontal Scrolling Announcement Plugin for WordPress
CVE-2023-4999
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 October 2023
What is CVE-2023-4999?
The Horizontal Scrolling Announcement plugin for WordPress is vulnerable to SQL Injection due to inadequate escaping of user-supplied parameters in its [horizontal-scrolling] shortcode. This issue affects versions up to and including 9.2. Authenticated attackers with subscriber-level permissions can exploit this flaw to inject additional SQL queries into existing ones, potentially leading to the extraction of sensitive information from the database.
Affected Version(s)
Horizontal scrolling announcement * <= 9.2