SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/feed.
oryginał ENCVSS Vector
AV:N/AC:L/Au:N/C:P/I:P/A:PWpml
APPWpml≤ 3.1.8
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Tagi
SQLi
CWE
Referencje
Powiązane podatności
CVE-2024-6386CRITICAL9.9PL ✓ten sam produkt
RCE w pluginie WPML dla WordPress via Twig Server-Side Template Injection
CVE-2015-2792HIGH7.5ten sam produkt
The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allow...
CVE-2025-3488MEDIUM6.4ten sam produkt
The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpml_language_swit...
CVE-2022-38974MEDIUM4.3ten sam produkt
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows user...
CVE-2022-38461MEDIUM5.4ten sam produkt
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows user...