https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:20:47 +0000 https://cve.radiocsirt.org/vuln/cve-2026-15300 <p><strong>Affected:</strong> ninjew GEO my WP</p> <p>The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the &#39;distance&#39;, &#39;lat&#39;, and &#39;lng&#39; parameters in versions up to, and including, 4.5.4. The values were read from $_SERVER[&#39;QUERY_STRING&#39;] via parse_str() (bypassing wp_magic_quotes, which does not cover $_SERVER), then passed through bare esc_sql() before being interpolated into unquoted numeric positions in the proximity-search query (HAVING/SELECT clause distance math, BETWEEN bounding-box pre-filter) built by gmw_locations_query() in plugins/posts-locator/includes/class-gmw-wp-query.php. Because esc_sql() only escapes string delimiters and these positions are numeric, payloads such as `1 OR SLEEP(3)` survived sanitization. Fixed in 4.5.5 by adding an upstream is_numeric() guard that short-circuits the WHERE clause to `AND 1 = 0` when either coordinate is non-numeric, and by replacing the three esc_sql() calls with (float) casts.</p> <p><strong>Affected:</strong> ninjew GEO my WP</p> <p>The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the &#39;distance&#39;, &#39;lat&#39;, and &#39;lng&#39; parameters in versions up to, and including, 4.5.4. The values were read from $_SERVER[&#39;QUERY_STRING&#39;] via parse_str() (bypassing wp_magic_quotes, which does not cover $_SERVER), then passed through bare esc_sql() before being interpolated into unquoted numeric positions in the proximity-search query (HAVING/SELECT clause distance math, BETWEEN bounding-box pre-filter) built by gmw_locations_query() in plugins/posts-locator/includes/class-gmw-wp-query.php. Because esc_sql() only escapes string delimiters and these positions are numeric, payloads such as `1 OR SLEEP(3)` survived sanitization. Fixed in 4.5.5 by adding an upstream is_numeric() guard that short-circuits the WHERE clause to `AND 1 = 0` when either coordinate is non-numeric, and by replacing the three esc_sql() calls with (float) casts.</p> https://cve.radiocsirt.org/vuln/cve-2026-15300