{"id":"CVE-2023-2221","aliases":["EUVD-2023-33733","GHSA-vf73-c5j9-3h2p"],"status":"published","title":"WP Custom Cursors \u003c 3.2 - Admin+ SQLi","description":"The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00945,"percentile":0.61504,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2023-06-19T10:52:42Z","modified":"2026-06-17T05:52:02Z","products":[{"vendor":"unknown","product":"wp custom cursors | wordpress cursor plugin"},{"vendor":"web_trendy","product":"wp custom cursors | wordpress cursor plugin"},{"vendor":"wp_custom_cursors_project","product":"wp_custom_cursors"}],"references":[{"url":"https://wpscan.com/vulnerability/6666688e-7239-4d40-a348-307cf8f3b657","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://wpscan.com/vulnerability/6666688e-7239-4d40-a348-307cf8f3b657/","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2221"},{"url":"https://github.com/advisories/GHSA-vf73-c5j9-3h2p"}],"sources":{"cve":[{"id":"CVE-2023-2221","title":"WP Custom Cursors \u003c 3.2 - Admin+ SQLi","description":"The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.","status":"published","published":"2023-06-19T10:52:42.024Z","modified":"2024-12-12T21:05:26.061Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:24.004321Z"}],"euvd":[{"id":"EUVD-2023-33733","description":"The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.","status":"published","published":"2023-06-19T10:52:42Z","modified":"2024-12-12T21:05:26Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:36.024922Z"}],"ghsa":[{"id":"GHSA-vf73-c5j9-3h2p","title":"The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a...","description":"The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.","status":"published","published":"2023-06-19T12:30:22Z","modified":"2024-04-04T04:56:39Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:56:28.408484Z"}],"nvd":[{"id":"CVE-2023-2221","description":"The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.","status":"published","published":"2023-06-19T11:15:09.987Z","modified":"2026-06-17T05:52:02.037Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:08:06.335469Z"}]}}