CVE-2022-0784

PoC —

CVSS 3.1

9.8 critical

EPSS

10%p95

Published

Mar 28, 2022 (Mar 28, 2022)

Modified

Jun 17, 2026

Description

The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection

Vendors: title experiments free project
Products: title experiments free
Ecosystems: WordPress
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (10.1%)

In the news0 stories

No ingested article mentions this CVE yet.