CVE-2024-4533

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin users to perform SQL injection attacks

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-453307.2A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to CVE-2024-453317.8A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzCVE-2024-453325.6Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect brCVE-2024-453337.3Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an authenticCVE-2024-453347.8Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthoriCVE-2024-453355.5Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted viruCVE-2024-453366.1The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an AuthorizatioCVE-2024-453379.1Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptibleCVE-2024-453385.3An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremelCVE-2024-453397.1When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file patCVE-2024-45346.1The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as esCVE-2024-453408.8Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credenti