Vulnerability · Published Nov 6, 2023 · Assigned by Patchstack
CVE-2023-38382WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection
Critical 9.8
In plain English
A critical-severity SQL injection in Subscribe to Category from Daniel Söderström / Sidney van de Stouwe. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)0.6%top 52.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category allows SQL Injection.This issue affects Subscribe to Category: from n/a through 2.7.4.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Daniel Söderström / Sidney van de Stouwe | Subscribe to Category | n/a – through 2.7.4 |
Weakness: CWE-89