CVE-2022-1687— Logo Slider <= 1.4.8 - Admin+ SQLi
Quick assessment
Affected
Unknown Logo Slider
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Logo Slider 1.4.8及其之前版本存在SQL注入漏洞，该漏洞源于插件在Manage Slider Images管理页面中使用的lsp_slider_id参数缺少过滤和转义。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-1687
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Logo Slider <= 1.4.8 - Admin+ SQLi
Source: CVE Program / CVE List V5
Vulnerability Description
The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injection
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Logo Slider SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Logo Slider 1.4.8及其之前版本存在SQL注入漏洞，该漏洞源于插件在Manage Slider Images管理页面中使用的lsp_slider_id参数缺少过滤和转义。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Logo Slider | 1.4.8 ~ 1.4.8 | - |
|
II. Public POCs for CVE-2022-1687
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-1687
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-1687 (1)
Other References for CVE-2022-1687 (1)
-
https://bulletin.iese.de/post/logo-slider_1-4-8 x_refsource_MISC
Same Patch Batch · Unknown · 2022-06-06 · 31 CVEs total
| CVE-2022-1598 | WPQA < 5.5 - Unauthenticated Private Message Disclosure | |
| CVE-2022-1712 | LiveSync for WordPress <= 1.0 - Arbitrary Settings Update via CSRF | |
| CVE-2022-1709 | Throws SPAM Away < 3.3.1 - Comment Deletion via CSRF | |
| CVE-2022-1695 | WP Simple Adsense Insertion < 2.1 - Inject ads and javascript via CSRF | |
| CVE-2022-1692 | CP Image Store with Slideshow < 1.0.68 - Unauthenticated SQLi | |
| CVE-2022-1691 | Realty Workstation < 1.0.15 - Agent SQLi | |
| CVE-2022-1690 | Note Press <= 0.1.10 - Admin+ SQLi via Bulk Actions | |
| CVE-2022-1689 | Note Press <= 0.1.10 - Admin+ SQLi via Update | |
| CVE-2022-1688 | Note Press <= 0.1.10 - Admin+ SQLi via id | |
| CVE-2022-1686 | Five Minute Webshop <= 1.3.2 - Admin+ SQLi via id | |
| CVE-2022-1685 | Five Minute Webshop <= 1.3.2 - Admin+ SQLi via orderby | |
| CVE-2022-1684 | Cube Slider <= 1.2 - Admin+ SQLi | |
| CVE-2022-1683 | amtyThumb <= 4.2.0 - Subscriber+ SQLi | |
| CVE-2022-1673 | WooCommerce Green Wallet Gateway < 1.0.2 - Reflected Cross Site Scripting in checkout page | |
| CVE-2022-1647 | FormCraft Basic < 1.2.6 - Admin+ Stored Cross Site Scripting | |
| CVE-2022-0779 | User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal | |
| CVE-2022-1597 | WPQA < 5.4 - Reflected Cross-Site Scripting | |
| CVE-2022-1577 | Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF | |
| CVE-2022-1570 | Files Download Delay < 1.0.7 - Subscriber+ Settings Reset | |
| CVE-2022-1569 | WordPress Forms by Pie Forms < 1.4.9.4 - Admin+ Stored Cross-Site Scripting |
Showing top 20 of 31 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Logo Slider
-
CVE-2026-24626
WordPress Logo Slider plugin <= 5.1.1 - Cross Site Scripting -
CVE-2025-13153
Logo Slider < 4.9.0 - Contributor+ Stored XSS -
CVE-2024-9233
GS Logo Slider < 3.7.1 - Settings Update via Cross-Site Requ -
CVE-2024-12308
Logo Slider < 4.6.0 - Contributor+ Stored XSS -
CVE-2024-10896
Logo Slider < 4.5.0 - Contributor+ Stored XSS
Same vendor: Unknown
-
CVE-2026-94274
YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Di -
CVE-2026-94297
Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitra -
CVE-2026-96886
Course Booking System < 7.0.9 - Unauthenticated Attendee PII -
CVE-2026-97316
Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF vi -
CVE-2026-92424
Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Qu
Same weakness: CWE-89
-
CVE-2026-102109
Kiteworks Secure Data Forms SQL injection -
CVE-2026-102098
Kiteworks Core SQL Injection -
CVE-2026-103232
AdithyaYelloju Restaurant-Management-System table_booking.ph -
CVE-2026-103231
AdithyaYelloju Restaurant-Management-System Order Cancellati -
CVE-2026-103230
AdithyaYelloju Restaurant-Management-System Order Placement
V. Comments for CVE-2022-1687
No comments yet