critical9.8
CVE-2022-0434
The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, …
Impact
The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| A3rev | Page View Count | before 2.4.15 |