CVE-2023-0098

The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.94% chance of exploitation in the next 30 days, 59th percentile

Published

2023-02-13

Updated

2025-03-21

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/db0b3275-40df-404e-aa8d-53558f0122d8

References

• CVE Record
• NVD entry

Related

• CVE-2023-0097
• CVE-2023-0099
• CVE-2023-0096
• CVE-2023-0106
• CVE-2023-0095
• CVE-2023-0107