CVE-2024-9796: Internet-Formation Wp-Advanced-Search

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

Affected products

• Internet-Formation Wp-Advanced-Search: before 3.3.9.2 (fixed in 3.3.9.2)

Published 2024-10-10. Last modified 2026-06-17.