What’s Vulnerable › Vulnerabilities

CVE-2023-6373: ArtPlacer Widget < 2.20.7 - Editor+ SQLi

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-16 · updated 2026-06-17
• Weakness: CWE-89

Description

The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)

Affected products

• ArtPlacer Widget: through 2.20.6

References

• https://wpscan.com/vulnerability/afc11c92-a7c5-4e55-8f34-f2235438bd1b/
• https://wpscan.com/vulnerability/afc11c92-a7c5-4e55-8f34-f2235438bd1b/

Get alerted when CVE-2023-6373 or the next vulnerability affects your stack