SQL Injection Vulnerability in ArielBrailovsky-ViralAd Plugin for WordPress

CVE-2025-2106

What is CVE-2025-2106?

The ArielBrailovsky-ViralAd plugin for WordPress suffers from a SQL injection vulnerability through the 'text' and 'id' parameters in the limpia() function. This flaw arises from inadequate escaping of user-supplied input and insufficient preparation of SQL queries, allowing unauthenticated attackers to manipulate existing queries. This could potentially lead to the extraction of sensitive data from the database, particularly affecting users running outdated versions of WordPress.

References