What’s Vulnerable › Vulnerabilities

CVE-2022-1688: Note Press <= 0.1.10 - Admin+ SQLi via id

• Severity: low (CVSS 2.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-08 · updated 2026-06-17
• Weakness: CWE-89

Description

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections

Affected products

• Note Press: through 0.1.10

References

• https://bulletin.iese.de/post/note-press_0-1-10_1
• https://wpscan.com/vulnerability/63d4444b-9b04-47f5-a692-c6c6c8ea7d92
• https://bulletin.iese.de/post/note-press_0-1-10_1
• https://wpscan.com/vulnerability/63d4444b-9b04-47f5-a692-c6c6c8ea7d92

Get alerted when CVE-2022-1688 or the next vulnerability affects your stack