CoreCVE
Back

CRITICAL

WP AutoComplete Search <= 1.0.4 - Unauthenticated SQLi

Published Jan 2, 2023

Description

The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner WPScan
Published Jan 2, 2023
Updated Apr 11, 2025
Reserved Dec 6, 2022
Link CVE-2022-4297
CISA Vulnrichment
Updated Apr 11, 2025
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2022-4297
Red Hat
Severity n/a
Public date n/a
Links CVE-2022-4297