What’s Vulnerable › Vulnerabilities

CVE-2022-1014: WP Contacts Manager <= 2.2.4 - Unauthenticated SQLi

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-23 · updated 2026-06-17
• Weakness: CWE-89

Description

The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.

Affected products

• WP Contacts Manager: through 2.2.4

References

• https://wpscan.com/vulnerability/eb9e202d-04aa-4343-86a2-4aa2edaa7f6b
• https://wpscan.com/vulnerability/eb9e202d-04aa-4343-86a2-4aa2edaa7f6b

Get alerted when CVE-2022-1014 or the next vulnerability affects your stack