CVE-2021-24952

CVE-2021-24952: Conversios.io < 4.6.2 - Subscriber+ SQL Injection

Vendor Unknown
Product Conversios.io – Google Analytics and Google Shopping plugin for WooCommerce
Weakness CWE-89 · SQLi
Published March 7, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_product_sync_bantch_wise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks.

Key dates

02Disclosure timeline

March 7, 2022 CVE published
August 3, 2024 Record updated