← Database

CVE-2022-4117

CRITICAL CVSS: 9.8 Published: 2022-12-26 Modified: 2026-06-17

Description

The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.

Affected Platforms

Iws-Geo-Form-Fields Project Iws-Geo-Form-Fields

Weakness Type

Unknown

References