high7.2
CVE-2022-0228
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in …
Impact
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sygnoos | Popup Builder | before 4.0.7 |