{"id":"CVE-2025-22352","aliases":["EUVD-2025-2751","GHSA-jghv-8ggj-pc3g"],"status":"published","title":"WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes Plugin \u003c= 1.4.9 - SQL Injection vulnerability","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes: from n/a through \u003c= 1.4.9.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00753,"percentile":0.55346,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2025-01-07T10:48:39Z","modified":"2026-06-17T08:46:42Z","exploits":[{"source":"pocgithub","id":"DoTTak/CVE-2025-22352","title":"DoTTak/CVE-2025-22352","date":"2025-01-06","url":"https://github.com/DoTTak/CVE-2025-22352"}],"products":[{"vendor":"elextensions","product":"elex woocommerce advanced bulk edit products, prices \u0026 attributes"}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/elex-bulk-edit-products-prices-attributes-for-woocommerce-basic/vulnerability/wordpress-elex-woocommerce-advanced-bulk-edit-products-prices-attributes-plugin-1-4-8-sql-injection-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22352"},{"url":"https://patchstack.com/database/wordpress/plugin/elex-bulk-edit-products-prices-attributes-for-woocommerce-basic/vulnerability/wordpress-elex-woocommerce-advanced-bulk-edit-products-prices-attributes-plugin-1-4-8-sql-injection-vulnerability?_s_id=cve"},{"url":"https://github.com/advisories/GHSA-jghv-8ggj-pc3g"}],"sources":{"cve":[{"id":"CVE-2025-22352","title":"WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes Plugin \u003c= 1.4.9 - SQL Injection vulnerability","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes: from n/a through \u003c= 1.4.9.","status":"published","published":"2025-01-07T10:48:39.074Z","modified":"2026-05-11T22:34:37.892Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:28.943062Z"}],"euvd":[{"id":"EUVD-2025-2751","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes: from n/a through \u003c= 1.4.9.","status":"published","published":"2025-01-07T10:48:39Z","modified":"2026-05-11T22:34:37Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T19:04:42.120376Z"}],"ghsa":[{"id":"GHSA-jghv-8ggj-pc3g","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes allows Blind SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes: from n/a through 1.4.8.","status":"published","published":"2025-01-07T12:31:01Z","modified":"2025-01-07T12:31:08Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:59:23.046181Z"}],"nvd":[{"id":"CVE-2025-22352","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes: from n/a through \u003c= 1.4.9.","status":"published","published":"2025-01-07T11:15:18.527Z","modified":"2026-06-17T08:46:42.173Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:10:48.373347Z"}]}}