SQL Injection Vulnerability in WP-Addpub Plugin for WordPress

CVE-2025-5563

What is CVE-2025-5563?

The WP-Addpub plugin for WordPress is susceptible to SQL Injection through the 'wp-addpub' shortcode across all versions up to and including 1.2.8. This vulnerability arises from inadequate escaping of user-provided parameters and insufficient preparation of the SQL query. As a result, authenticated attackers with Contributor-level access or higher can inject additional SQL queries into existing queries, potentially leading to the unauthorized extraction of sensitive data from the database.

References