Ngg Smart Image Search
Monthly
SQL injection in the NGG Smart Image Search WordPress plugin (all versions before 4.0.0) lets remote attackers inject arbitrary SQL through the plugin's search functionality without authentication. Because the CVSS vector marks privileges as none and user interaction as none, any visitor can reach the vulnerable query, and the scope-changed high-confidentiality rating (9.3) reflects potential exposure of the entire WordPress database, including credentials and secrets. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported by Patchstack.
The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' shortcode in all versions up to, and including, 3.2.1 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
SQL injection in the NGG Smart Image Search WordPress plugin (all versions before 4.0.0) lets remote attackers inject arbitrary SQL through the plugin's search functionality without authentication. Because the CVSS vector marks privileges as none and user interaction as none, any visitor can reach the vulnerable query, and the scope-changed high-confidentiality rating (9.3) reflects potential exposure of the entire WordPress database, including credentials and secrets. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported by Patchstack.
The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' shortcode in all versions up to, and including, 3.2.1 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.