CVE-2019-25745

HIGH 8.8 CVSS 4.0

Published: June 4, 2026
Last modified: July 22, 2026
NVD status: Deferred
Reported by: disclosure@vulncheck.com
Weakness: CWE-89
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.

Affected WordPress components

WP Google Review Slider Plugin · wp-google-places-review-slider

Confirmed match Active

Version 6.1
View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

jgwhite33 Google Review Slider — Version 6.1

References

wordpress.org https://wordpress.org/plugins/wp-google-places-review-slider/
www.exploit-db.com https://www.exploit-db.com/exploits/47567
www.vulncheck.com https://www.vulncheck.com/advisories/wordpress-plugin-google-review-slider-sql-injection-via-tid
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected WordPress components

Affected products and versions

References