blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-1692

CRITICAL 9.8 CVSS 3.1
Published
June 8, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-89
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack

Affected WordPress components

  • CP Image Store with Slideshow Plugin · cp-image-store
    Confirmed match Active
    From 1.0.68 (including) to 1.0.68 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown CP Image Store with Slideshow — From 1.0.68 (including) to 1.0.68 (excluding)
  • dwbooster cp_image_store_with_slideshow — Before 1.0.68

References

  • bulletin.iese.de https://bulletin.iese.de/post/cp-image-store_1-0-67 Exploit, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/83bae80c-f583-4d89-8282-e6384bbc7571 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record