CVE-2022-3494

Complianz (Free < 6.3.4, Premium < 6.3.6) - Translator SQLi

The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML.

Affected

Complianz – GDPR/CCPA Cookie Consent · Complianz Premium

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.32% chance of exploitation in the next 30 days, 70th percentile

Published

2022-11-07

Updated

2025-05-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/71db75c0-5907-4237-884f-8db88b1a9b34

References

• CVE Record
• NVD entry