CVE-2019-25746

HIGH 7.1 CVSS 4.0

Published: June 15, 2026
Last modified: June 17, 2026
NVD status: Deferred
Reported by: disclosure@vulncheck.com
Weakness: CWE-89
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.

Affected WordPress components

Sliced Invoices – WordPress Invoice Plugin Plugin · sliced-invoices

Confirmed match Active

Version 3.8.2
View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

SlicedInvoices Sliced Invoices — Version 3.8.2

References

slicedinvoices.com https://slicedinvoices.com/
wordpress.org https://wordpress.org/plugins/sliced-invoices/
www.exploit-db.com https://www.exploit-db.com/exploits/47540
www.vulncheck.com https://www.vulncheck.com/advisories/wordpress-sliced-invoices-sql-injection-via-post-parameter
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected WordPress components

Affected products and versions

References