SQL Injection Vulnerability in ProjectList Plugin for WordPress

CVE-2025-13370

What is CVE-2025-13370?

The ProjectList plugin for WordPress is susceptible to a time-based SQL Injection due to inadequate escaping of user-supplied parameters and ill-prepared SQL queries. This vulnerability allows authenticated users with Editor-level access or higher to inject additional SQL commands via the 'id' parameter, potentially enabling them to retrieve sensitive data from the database. This poses a significant risk as it can lead to unauthorized access to confidential information.

References