SQL Injection Vulnerability in Hero Slider by WordPress
CVE-2024-13809
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 March 2025
What is CVE-2024-13809?
The Hero Slider plugin for WordPress is subject to SQL Injection vulnerabilities, impacting all versions up to and including 1.3.5. Due to inadequate escaping of user-supplied data and insufficient preparation of SQL queries, authenticated attackers with Subscriber-level access or higher can inject additional SQL queries into existing ones. This may allow them to extract sensitive information from the database, posing a significant risk to users and their data integrity.
Affected Version(s)
Hero Slider - WordPress Slider Plugin * <= 1.3.5