The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allow…
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.10383·Published 2022-06-06·Fixed in 1.0.68CWE-89