SQL Injection Vulnerability in HSAS Plugin for WordPress

CVE-2023-5000

What is CVE-2023-5000?

The Horizontal Scrolling Announcements plugin for WordPress is susceptible to SQL Injection attacks due to insufficient parameter escaping in the 'hsas-shortcode' shortcode. This issue affects versions up to and including 2.4. Authenticated users, particularly those with contributor-level permissions or higher, can exploit this vulnerability to modify SQL queries. By appending unauthorized SQL commands, attackers can potentially expose sensitive data stored in the database, creating serious risks for the integrity and confidentiality of the site's information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References