← Back to browse · API

CVE-2022-4297

Severity
CRITICAL
CVSS
9.8
EPSS
0.03595
Risk score
40.46
CISA KEV
No
PoC
No
Published
2023-01-02
Modified
2025-04-11
First seen
2026-08-07
Aliases
EUVD-2022-51653, GHSA-XCGC-GW57-WR9F
Products
Unknown:WP AutoComplete Search 0 ≤1.0.4
Sources
euvd EUVD-2022-51653

Description

The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection

References