Vulnerability · Published Apr 11, 2022 · Assigned by WPScan
CVE-2022-1023Podcast Importer SecondLine < 1.3.8 - Admin+ SQLi
High 7.2
In plain English
A high-severity SQL injection in Podcast Importer SecondLine from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS NVD)7.2High
Exploit odds (30 days)1.5%top 25.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Podcast Importer SecondLine | 1.3.8 – before 1.3.8 |
Weakness: CWE-89
References
- https://wpscan.com/vulnerability/163069cd-98a8-4cfb-8b58-a6727a7d5c48 x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2696254 x_refsource_CONFIRM