CVE-2017-9834: Calendarscripts Watupro

Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days.

SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php.

Affected products

• Calendarscripts Watupro: up to and including 5.5.1

Published 2017-09-07. Last modified 2026-06-17.