SQL Injection Vulnerability in NotFound Multiple Carousel Plugin by WordPress
CVE-2025-22553

9.3CRITICAL

Key Information:

Vendor
Notfound
Status
Multiple Carousel
Vendor
CVE Published:
21 January 2025

Summary

The NotFound Multiple Carousel plugin for WordPress contains a vulnerability that allows attackers to exploit SQL injection flaws. This occurs due to improper neutralization of special elements within SQL commands, enabling unauthorized manipulation of database queries. If left unpatched, this vulnerability could allow attackers to access, modify, or delete sensitive data from the database. The affected versions range from n/a through 2.0, highlighting the necessity for users to review their installations and apply necessary security updates.

Affected Version(s)

Multiple Carousel <= 2.0

References

https://patchstack.com/database/wordpress/plugin/multicar...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

thiennv (Patchstack Alliance)
.