{"id":"CVE-2023-0630","summary":"Slimstat Analytics \u003c 4.9.3.3 - Subscriber+ SQL Injection","details":"The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.","modified":"2026-08-12T03:51:46.570573237Z","published":"2023-03-20T15:52:13.523Z","database_specific":{"cna_assigner":"WPScan","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0630.json","unresolved_ranges":[{"extracted_events":[{"introduced":"4.1"},{"fixed":"4.9.3.3"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"fixed":"4.9.3.3"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"https://wordpress.org/plugins"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0630.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0630"},{"type":"EVIDENCE","url":"https://wpscan.com/vulnerability/b82bdd02-b699-4527-86cc-d60b56ab0c55"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wp-slimstat/wp-slimstat","events":[{"introduced":"0"},{"fixed":"f17b1b2a34802e612d69cc9f8f5aed5dbab6c0c1"}],"database_specific":{"cpe":"cpe:2.3:a:wp-slimstat:slimstat_analytics:*:*:*:*:*:wordpress:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.9.3.3"}],"source":"CPE_RANGE"}}],"versions":["v4.9.3.2","v4.9.3.1","v4.9.3","v4.9.2","4.9.0.1","4.9","4.8.3","4.8.2","4.8.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0630.json"}}],"schema_version":"1.9.0"}