EUVD-2025-17161
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3DescriptionNVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nir Complete Google Seo Scan allows SQL Injection. This issue affects Complete Google Seo Scan: from n/a through 3.5.1.
AnalysisAI
SQL Injection vulnerability in Nir Complete Google SEO Scan plugin (versions up to 3.5.1) that allows authenticated attackers with high privileges to execute arbitrary SQL commands against the database. While the CVSS score is 7.6 (high), the attack requires administrative credentials and does not enable data modification, limiting real-world impact to information disclosure and service degradation. No active exploitation in the wild has been confirmed at this time.
Technical ContextAI
The vulnerability exists in the Complete Google SEO Scan WordPress plugin, a tool designed to scan and analyze websites for Google SEO compliance. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input is inadequately sanitized before being incorporated into SQL queries. The affected component likely processes SEO scan parameters, filter criteria, or report generation functions without proper parameterized query implementation or input validation. The plugin operates within the WordPress ecosystem, meaning vulnerability exploitation would occur through the WordPress database abstraction layer (typically MySQL/MariaDB). The issue affects versions from an unspecified baseline through version 3.5.1.
Share
External POC / Exploit Code
Leaving vuln.today