What’s Vulnerable › Vulnerabilities

CVE-2024-3265: WP Advanced Search <= 1.1.6 - Admin+ SQL Injection

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-04-25 · updated 2026-06-17
• Weakness: CWE-89

Description

The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.

Affected products

• Advance Search: through 1.1.6

References

• https://wpscan.com/vulnerability/ecb74622-eeed-48b6-a944-4e3494d6594d/
• https://wpscan.com/vulnerability/ecb74622-eeed-48b6-a944-4e3494d6594d/

Get alerted when CVE-2024-3265 or the next vulnerability affects your stack