Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection

Summary

The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection

Timeline

1. Mar 21, 2022, 6:56 PM UTCCVE published
2. Aug 2, 2024, 11:40 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Unknown Infographic Maker – iList

  From 4.3.8 · fixed in 4.3.8

References 3