Time-Based SQL Injection in JS Archive List Plugin for WordPress

CVE-2025-7670

What is CVE-2025-7670?

The JS Archive List plugin for WordPress suffers from a time-based SQL injection vulnerability, primarily due to insufficient input escaping and lack of proper preparation of user-supplied parameters within the build_sql_where() function. This vulnerability allows unauthenticated attackers to craft malicious SQL queries, enabling them to inject and execute arbitrary SQL commands. As a result, sensitive information can be compromised as attackers gain unauthorized access to the database. Users are advised to update to a secure version of the plugin to mitigate potential threats.

References