CVE-2024-3265

4.7 mediumEPSS 0.4%

Medium (4.7) in advance search project advance search. EPSS 0.4% chance of exploitation in the next 30 days.

The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.

Severity

CVSS 3.1

4.7 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2024-04-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

advance_search_project:advance_search

References

https://wpscan.com/vulnerability/ecb74622-eeed-48b6-a944-4e3494d6594d/
https://wpscan.com/vulnerability/ecb74622-eeed-48b6-a944-4e3494d6594d/

Check your stack JSON