CVSS: 8.3EPSS: 8%CPEs: 1EXPL: 1CVE-2023-0900 – AP Pricing Tables Lite <= 1.1.6 - Admin+ SQLi
https://notcve.org/view.php?id=CVE-2023-0900
10 May 2023 — The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins. The AP Pricing Tables Lite plugin for WordPress is vulnerable to SQL Injection via the 'table_id' parameter passed through the appts_backend_ajax AJAX function in versions up to, and including, 1.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient prepara... • https://wpscan.com/vulnerability/f601e637-a486-4f3a-9077-4f294ace7ea1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0640 – AP Pricing Tables Lite < 1.1.5 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-0640
28 Feb 2022 — The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. El plugin Pricing Table Builder de WordPress versiones anteriores a 1.1.5, no sanea y escapa del parámetro postid antes de devolverlo a una página de administración, conllevando a un problema de tipo Cross-Site Scripting Reflejado • https://plugins.trac.wordpress.org/changeset/2684253 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •