TI-2025-08653 CVE-2025-9441 · GHSA-85ww-f74g-8f87
iATS Online Forms <= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter
Priority LOW 29
The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order' parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lac…