High · 7.6 CVE-2024-47334 EUVD-2024-42370GHSA-q9h7-27gp-hwp9

WordPress Zoho Flow for WordPress plugin <= 2.7.1 - SQL Injection vulnerability

Published Oct 9, 2024 · Updated May 11, 2026 · Assigned by Patchstack

Vendor: Zoho Flow Product: Zoho Flow Category: Web / CMS

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Flow Zoho Flow zoho-flow allows SQL Injection.This issue affects Zoho Flow: from n/a through <= 2.7.1.

Affected products

Vendor	Product	Affected	Fixed
Zoho Flow	Zoho Flow	≤ 2.7.1	—

References

https://patchstack.com/database/Wordpress/Plugin/zoho-flow/vulnerability/wordpress-zoho-flow-plugin-2-7-1-sql-injection-vulnerability?_s_id=cve vdb-entry