/Vulnerability Library

CP Image Store with Slideshow <= 1.0.67 - SQL Injection

CVE-2022-1692
Verified

Description

The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack.

Severity

Critical

CVSS Score

9.8

Exploit Probability

11%

Published Date

February 26, 2026

Template Author

shivam kamboj

CVE-2022-1692.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2022-1692
CWE ID:
cwe-89

References

https://wpscan.com/vulnerability/83bae80c-f583-4d89-8282-e6384bbc7571/https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cp-image-store/cp-image-store-with-slideshow-1067-unauthenticated-sql-injectionhttps://nvd.nist.gov/vuln/detail/CVE-2022-1692

Remediation Steps

Update to version 1.0.68 or later.