Back to KEVs

CVE-2022-0747

Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection

Basic Information

CVE State
PUBLISHED
Reserved Date
February 24, 2022
Published Date
March 21, 2022
Last Updated
August 02, 2024
Vendor
QuantumCloud
Product
Infographic Maker – iList
Description
The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Tags
wordpress nuclei_scanner

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Score

Score
82.19% (Percentile: 99.15%) as of 2025-06-08

Exploit Status

Exploited in the Wild
Yes (2025-05-11 00:00:00 UTC) Source

References

https://wpscan.com/vulnerability/a8575322-c2cf-486a-9c37-71a22167aac3 https://plugins.trac.wordpress.org/changeset/2684336

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-05-11 00:00:00 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0747.yaml 2025-04-26 00:00:00 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Detected by Nuclei

  • Added to KEVIntel