The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to…
CVSS 3.1HIGH 8.8·Network·Low privileges·No interaction·EPSS 0.011·Published 2024-01-17·Fixed in 0.3.12CWE-89