What’s Vulnerable › Vulnerabilities

CVE-2023-0098: Simple URLs < 115 - Subscriber+ SQLi

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-13 · updated 2026-06-17

Description

The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.

Affected products

• Lasso Simple URLs: before 115 — fixed in 115

How to fix

Upgrade to a fixed version: Lasso Simple URLs 115. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/db0b3275-40df-404e-aa8d-53558f0122d8
• https://wpscan.com/vulnerability/db0b3275-40df-404e-aa8d-53558f0122d8

Get alerted when CVE-2023-0098 or the next vulnerability affects your stack