SQL Injection Vulnerability in HSAS Plugin for WordPress

CVE-2023-5000

Summary

The Horizontal Scrolling Announcements plugin for WordPress is susceptible to SQL Injection attacks due to insufficient parameter escaping in the 'hsas-shortcode' shortcode. This issue affects versions up to and including 2.4. Authenticated users, particularly those with contributor-level permissions or higher, can exploit this vulnerability to modify SQL queries. By appending unauthorized SQL commands, attackers can potentially expose sensitive data stored in the database, creating serious risks for the integrity and confidentiality of the site's information.

References