CVE-2022-0254

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	WordPress Zero Spam	>= 5.2.11, < 5.2.11

References

https://plugins.trac.wordpress.org/changeset/2660225Patch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2680906Patch, Third Party Advisory
https://wpscan.com/vulnerability/ae54681f-7b89-408c-b0ee-ba4a520db997Exploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2660225Patch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2680906Patch, Third Party Advisory
https://wpscan.com/vulnerability/ae54681f-7b89-408c-b0ee-ba4a520db997Exploit, Third Party Advisory

Timeline

Published: Mar 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-02557.2The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL CVE-2022-02565.4pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-02575.4pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-02588.8pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command CVE-2022-02605.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7.CVE-2022-02617.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-02626.1Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.CVE-2022-02637.8Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.CVE-2022-02645.5A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be ret CVE-2022-02659.8Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.CVE-2022-02666.6Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.CVE-2022-02677.2The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adro