CVE-2022-1685

4.9 mediumEPSS 1.0%

Medium (4.9) in five minute webshop project five minute webshop. EPSS 1.0% chance of exploitation in the next 30 days.

The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection

Severity

CVSS 3.1

4.9 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2022-06-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

five_minute_webshop_project:five_minute_webshop

References

https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1
https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97
https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1
https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97

Check your stack JSON