{"id":"CVE-2022-2460","aliases":["EUVD-2022-34721","GHSA-rv2q-xwg7-w99w"],"status":"published","title":"WPDating \u003c 7.4.0 - Multiple Unauthenticated SQLi","description":"The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.011,"percentile":0.65897,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2022-08-08T13:51:32Z","modified":"2026-06-17T04:41:56Z","products":[{"vendor":"digital_product_labs","product":"wpdating"},{"vendor":"unknown","product":"wpdating"}],"references":[{"url":"https://wpscan.com/vulnerability/694b6dfd-2424-41b4-8595-b6c305c390db","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2460"},{"url":"https://github.com/advisories/GHSA-rv2q-xwg7-w99w"}],"sources":{"cve":[{"id":"CVE-2022-2460","title":"WPDating \u003c 7.4.0 - Multiple Unauthenticated SQLi","description":"The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users","status":"published","published":"2022-08-08T13:51:32Z","modified":"2025-09-03T19:03:00.211Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-34721","description":"The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users","status":"published","published":"2022-08-08T13:51:32Z","modified":"2025-09-03T19:03:00Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:47.847286Z"}],"ghsa":[{"id":"GHSA-rv2q-xwg7-w99w","title":"The WPDating WordPress plugin through 7.1.9 does not properly escape user input before...","description":"The WPDating WordPress plugin through 7.1.9 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities.","status":"published","published":"2022-08-09T00:00:25Z","modified":"2023-02-01T05:02:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:49:56.778846Z"}],"nvd":[{"id":"CVE-2022-2460","description":"The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users","status":"published","published":"2022-08-08T14:15:10.697Z","modified":"2026-06-17T04:41:56.15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:24.39467Z"}]}}