SQL Injection Vulnerability in Wp Tabber Widget Plugin for WordPress

CVE-2025-10730

What is CVE-2025-10730?

The Wp Tabber Widget Plugin for WordPress is susceptible to SQL Injection through the 'wp-tabber-widget' shortcode across all versions up to and including 4.0. This vulnerability arises from inadequate escaping of user-supplied parameters and insufficient preparation of the existing SQL queries. Authenticated attackers with Contributor-level access or higher can exploit this weakness to inject additional SQL commands into existing queries, potentially allowing them to retrieve sensitive information from the database.

References