CVE-2023-6373 — ArtPlacer Widget < 2.20.7 - Editor+ SQLi
The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and abo…
Published: 2024-01-16 · CVSS: 8.8 · CVSS 3.1
The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7