8.8
High
CVE-2022-3860 The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a…
Description
The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Visual Email Designer for WooCommerce 1.7 | earliest → < 1.7.2 | 1.7.2 |