by Kastro
Paper/Archive/CVE-2025-1446

CVE-2025-1446

Unknown Pods — Pods < 3.2.8.2 - Admin+ SQL Injection

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.5.365 × 207.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

Affected

ProductAffectedFixed inSource
Pods< 3.2.8.23.2.8.2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP4.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

exploitwpscan.com/vulnerability/c170fb45-7ed5-40ef-99f6-8da035a23d89