CVE-2023-0630

The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

5.14% chance of exploitation in the next 30 days, 92th percentile

Nuclei

high · CWE-89

Published

2023-03-20

Updated

2025-02-26

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/b82bdd02-b699-4527-86cc-d60b56ab0c55
• RandomRobbieBF/CVE-2023-06302★ · 2023-06-12

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0630.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2023-0629
• CVE-2023-0631
• CVE-2023-0618
• CVE-2023-0632
• CVE-2023-0617
• CVE-2023-0637