CVE-2022-3768: Wpsmartcontracts

High severity, CVSS 8.8. EPSS: 4% chance of exploitation in the next 30 days.

The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author

Affected products

• Wpsmartcontracts Wpsmartcontracts: before 1.3.12 (fixed in 1.3.12)

Published 2022-11-28. Last modified 2026-06-17.