Saveto Wishlist Lite
Monthly
Unauthenticated SQL injection in the SaveTo Wishlist Lite WordPress plugin before 1.1.5 allows remote attackers to append arbitrary SQL queries to the ORDER BY clause of a database query, enabling extraction of sensitive information from the WordPress database. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and there is no indication of active exploitation (CISA KEV not listed). The vendor has released a patch in version 1.1.5.
Unauthenticated SQL injection in the SaveTo Wishlist Lite WordPress plugin before 1.1.5 allows remote attackers to append arbitrary SQL queries to the ORDER BY clause of a database query, enabling extraction of sensitive information from the WordPress database. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and there is no indication of active exploitation (CISA KEV not listed). The vendor has released a patch in version 1.1.5.