https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:30:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-355182 EUVD-2026-355182 https://cve.radiocsirt.org/vuln/euvd-2026-355182 https://cve.radiocsirt.org/vuln/fkie_cve-2026-17582 <p>The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb-&gt;update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the &#39;heroduplicateslider&#39; task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb-&gt;query() — with no $wpdb-&gt;prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> <p>The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb-&gt;update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the &#39;heroduplicateslider&#39; task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb-&gt;query() — with no $wpdb-&gt;prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-17582 https://cve.radiocsirt.org/vuln/ghsa-vxq7-r2mm-g784 <p>The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb-&gt;update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the &#39;heroduplicateslider&#39; task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb-&gt;query() — with no $wpdb-&gt;prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> <p>The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb-&gt;update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the &#39;heroduplicateslider&#39; task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb-&gt;query() — with no $wpdb-&gt;prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> https://cve.radiocsirt.org/vuln/ghsa-vxq7-r2mm-g784