SQL Injection Vulnerability in Filter & Grids Plugin for WordPress

CVE-2025-10289

What is CVE-2025-10289?

The Filter & Grids plugin for WordPress is susceptible to an SQL Injection vulnerability through the 'phrase' parameter. This occurs due to inadequate escaping of user-supplied input combined with insufficient preparation of the associated SQL query. Attackers without authentication can exploit this vulnerability to inject additional SQL commands, potentially gaining access to sensitive database information. This issue affects all versions up to and including 3.2.0 and is specifically executable on MariaDB, as queries result in a syntax error under MySQL.

References