CVE-2024-4533: KKProgressbar2 Free <= 1.1.4.2 - Admin+ SQL Injection

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-05-27 · updated 2026-06-17
Weakness: CWE-89

Description

The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin users to perform SQL injection attacks

Affected products

KKProgressbar2 Free: 1.0, 1.0.1, 1.1, 1.1.1, 1.1.2, 1.1.4 (+5)

References

https://wpscan.com/vulnerability/c3406236-aaee-480a-8931-79c867252f11/
https://wpscan.com/vulnerability/c3406236-aaee-480a-8931-79c867252f11/

Get alerted when CVE-2024-4533 or the next vulnerability affects your stack