CVE-2022-0747: Quantumcloud Infographic Maker

Critical severity, CVSS 9.8. EPSS: 14.9% chance of exploitation in the next 30 days.

The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection

Affected products

• Quantumcloud Infographic Maker: before 4.3.8 (fixed in 4.3.8)

Published 2022-03-21. Last modified 2026-06-17.