Description
The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Video Embed | 1.0 – ≤ 1.0 | — |