The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to a…
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.10079·Published 2022-03-28·Fixed in 9.0.1CWE-89