CVE-2024-11732

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The BP Profile Shortcodes Extra plugin for WordPress is vulnerable to time-based SQL Injection via the ‘tab’ parameter in all versions up to, and including, 2.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Dec 3, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-117337.3The The WordPress Popular Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.CVE-2024-117346.5A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to d CVE-2024-117364.9A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through u CVE-2024-117379.8CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of th CVE-2024-117387.5A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello me CVE-2024-117399.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics Case ERP allows SQL I CVE-2024-11748.2Previous versions of HP ThinPro (prior to HP ThinPro 8.0 SP 8) could potentially contain security vulnerabilities. HP has released HP ThinPr CVE-2024-117407.3The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. T CVE-2024-117414.3Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected CVE-2024-117425.4A vulnerability, which was classified as problematic, has been found in SourceCodester Best House Rental Management System 1.0. This issue a CVE-2024-117434.3A vulnerability, which was classified as problematic, was found in SourceCodester Best House Rental Management System 1.0. Affected is an un CVE-2024-117449.8A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerabili