{"id":"CVE-2025-49897","state":"PUBLISHED","title":"WordPress Vertical scroll slideshow gallery v2 plugin <= 9.1 - SQL Injection vulnerability","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1.","publishedAt":"2025-08-15T15:13:13.206Z","updatedAt":"2026-04-28T16:13:07.336Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Patchstack"},"assigner":"Patchstack","products":["gopiplus Vertical scroll slideshow gallery v2"],"affected":[{"vendor":"gopiplus","product":"Vertical scroll slideshow gallery v2","packageName":"vertical-scroll-slideshow-gallery-v2","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"9.1","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://patchstack.com/database/wordpress/plugin/vertical-scroll-slideshow-gallery-v2/vulnerability/wordpress-vertical-scroll-slideshow-gallery-v2-plugin-9-1-sql-injection-vulnerability?_s_id=cve"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/49xxx/CVE-2025-49897.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-49897","state":"PUBLISHED","datePublished":"2025-08-15T15:13:13.206Z","dateUpdated":"2026-04-28T16:13:07.336Z","assignerShortName":"Patchstack","assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateReserved":"2025-06-11T16:06:34.446Z"},"containers":{"cna":{"title":"WordPress Vertical scroll slideshow gallery v2 plugin <= 9.1 - SQL Injection vulnerability","descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1."}],"affected":[{"vendor":"gopiplus","product":"Vertical scroll slideshow gallery v2","packageName":"vertical-scroll-slideshow-gallery-v2","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"9.1","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/vertical-scroll-slideshow-gallery-v2/vulnerability/wordpress-vertical-scroll-slideshow-gallery-v2-plugin-9-1-sql-injection-vulnerability?_s_id=cve","tags":["vdb-entry"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Patchstack","orgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateUpdated":"2026-04-28T16:13:07.336Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Peter Thaleikis (Patchstack Alliance)"}],"impacts":[{"capecId":"CAPEC-7","descriptions":[{"lang":"en","value":"CAPEC-7 Blind SQL Injection"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-15T19:10:53.635362Z","id":"CVE-2025-49897","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-15T19:11:03.781Z"}}]}}}