CVE-2023-4598

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-4598

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4598.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-4598

Published

2023-10-20T07:15:15.933Z

Modified

2026-04-10T05:01:46.048001Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

References

Affected packages

Git / github.com/wp-slimstat/wp-slimstat

Affected ranges

Type

GIT

Repo

https://github.com/wp-slimstat/wp-slimstat

Events

Introduced

Fixed

1d422261475befae94ca59303c5e0c8414aa1003

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.10"
        }
    ]
}

Affected versions

4.*

4.8.1

4.8.2

4.8.3

4.9

4.9.0.1

v4.*

v4.9.2

v4.9.3

v4.9.3.1

v4.9.3.2

v4.9.3.3

v4.9.4

v5.*

v5.0

v5.0.1

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.5.1

v5.0.6

v5.0.7

v5.0.8

v5.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4598.json"