CVE-2022-4445

The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - contact@wpscan.com

Published

2023-02-13

Last modified

2025-03-21

Weaknesses

CWE-89

Affected products

• Fl3r Feelbox (Armandofiore)
• Fl3r Feelbox (Unknown)

References

• https://wpscan.com/vulnerability/9bb6fde0-1347-496b-be03-3512e6b7e8f8