Skip to content
Sign in
7.2 High

CVE-2022-3689 The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL…

Description

The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users

Affected products and versions

Product Affected versions Fixed in
HTML Forms 1.3 earliest → < 1.3.25 1.3.25

Other CVEs of HTML Forms

The 3 CVEs of HTML Forms →
CVE-2024-6412 The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers… 6.5 Medium CVE-2024-6243 The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing… 5.9 Medium
Track this CVE