The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL inject…
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.0068·Published 2025-05-15·Fixed in 1.4.3CWE-89
The Simple Video Directory WordPress plugin before 1.4.4 does not sanitise and escape some of its settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks even when the unfiltere…
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.00335·Published 2024-07-12·Fixed in 1.4.4CWE-79