What’s Vulnerable › Vulnerabilities

CVE-2022-22735: Simple Quotation <= 1.3.2 - Subscriber+ SQL injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-14 · updated 2026-06-17
• Weakness: CWE-89

Description

The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks

Affected products

• Simple Quotation: through 1.3.2

References

• https://wpscan.com/vulnerability/6940a97e-5a75-405c-be74-bedcc3a8ee00
• https://wpscan.com/vulnerability/6940a97e-5a75-405c-be74-bedcc3a8ee00

Get alerted when CVE-2022-22735 or the next vulnerability affects your stack