Skip to content
Sign in
8.8 High

CVE-2022-3494 The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators…

Description

The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML.

Affected products and versions

Product Affected versions Fixed in
Complianz – GDPR/CCPA Cookie Consent 6.3 earliest → < 6.3.4 6.3.4
Complianz Premium 6.3 earliest → < 6.3.6 6.3.6

Other CVEs of Complianz – GDPR/CCPA Cookie Consent

The 2 CVEs of Complianz – GDPR/CCPA Cookie Consent →
CVE-2022-0193 The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in… Not rated
Track this CVE