CVE-2022-1556: ERA404 Stafflist

Critical severity, CVSS 9.8. EPSS: 20.1% chance of exploitation in the next 30 days.

The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection

Affected products

• ERA404 Stafflist: before 3.1.5 (fixed in 3.1.5)

Published 2022-05-30. Last modified 2026-06-17.