vulnerability

WordPress Plugin: visualizer: CVE-2024-35736: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Try Surface Command
Back to search
Severity
9
CVSS
(AV:N/AC:L/Au:S/C:C/I:C/A:C)
Published
Jun 6, 2024
Added
May 15, 2025
Modified
Jul 9, 2025

Description

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to SQL Injection via the saveQuery function() in all versions up to, and including, 3.11.1 due to a missing capability check on a function that runs SQL Queries. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Solution

visualizer-plugin-cve-2024-35736

References

Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today