Syed Sheeraz Ali

The issue concerns the view submission functionality in the plugin, which makes a GET request with the `sub id` parameter. This parameter is not sanitized, escaped, or validated before being inserted into a SQL statement, leading to an SQL injection.

The issue concerns the `xmlfeed` in the Tradetracker-Store WordPress plugin, where the `test` parameter is not properly sanitized, escaped, or validated before being inserted into a SQL statement. This leads to SQL injection.

The Add new scene functionality in the Responsive 3D Slider WordPress plugin uses an `id` parameter which is not sanitised, escaped or validated before being inserted to a SQL statement, leading to SQL injection. This is a time-based SQL injection and in the same function, the vulnerable parameter is passed twice, so if a time of 5 seconds is passed, it takes 10 seconds to return since the query is ran twice.

The issue arises from the edit functionality in the MicroCopy WordPress plugin, which makes a GET request to fetch a related option. The `id` parameter used in this process is not sanitized, escaped, or validated before being inserted into a SQL statement, leading to SQL injection.

The issue concerns the `check order` function, which uses an `area id` parameter that is not sanitized, escaped, or validated before being inserted into a SQL statement, leading to SQL injection.

The issue concerns the Edit Role functionality in the Display Users WordPress plugin. It has an `id` parameter that is not properly sanitized, escaped, or validated before being inserted into a SQL statement. This oversight leads to SQL injection.

The issue concerns the Edit domain functionality in the WP Domain Redirect WordPress plugin, where the `editid` parameter is not properly sanitized, escaped, or validated before being inserted into a SQL statement. This oversight leads to SQL injection.

The Orders functionality in the WP iCommerce WordPress plugin has an `order id` parameter that is not sanitized, escaped, or validated before being inserted into a SQL statement, leading to SQL injection. This feature is available to low-privilege users, such as contributors.

The Orders functionality in the WordPress Page Contact plugin has an issue where the `order id` parameter is not properly sanitized, escaped, or validated before being inserted into a SQL statement. This leads to SQL injection and the feature is accessible to low-privilege users, such as contributors.

The issue concerns the WP-Board WordPress plugin, where the `options.php` file accepts a `postid` parameter without proper sanitization, escaping, or validation before inserting it into a SQL statement. This leads to a time-based SQL injection. The vulnerable parameter is passed twice in the same function, resulting in a prolonged response time if a specific time delay is introduced.

The issue arises from the fetch product ajax functionality in the Product Feed, where the `product id` POST parameter is not properly sanitised, escaped, or validated before being inserted into a SQL statement, leading to SQL injection.

The issue arises from the `pageid` GET parameter not being sanitised, escaped, or validated before being inserted into a SQL statement, leading to SQL injection. This allows for potential manipulation of database queries.

The issue arises from the `editid` GET parameter of the Cashtomer WordPress plugin, which is not properly sanitised, escaped, or validated before being inserted into a SQL statement. This leads to SQL injection.

The issue arises from the improper sanitization, escaping, or validation of the `id` GET parameter in the WordPress Membership SwiftCloud.io WordPress plugin, leading to SQL injection.

The issue arises from a `c` GET parameter in the Comment Highlighter WordPress plugin that is not properly sanitized, escaped, or validated before being inserted into a SQL statement, leading to SQL injection.

The issue is related to the `id` GET parameter in the Easy Testimonial Manager WordPress plugin, which is not properly sanitized, escaped, or validated before being inserted into a SQL statement. This leads to SQL injection.

The issue arises from the `editid` GET parameter not being sanitized, escaped, or validated before being inserted into a SQL statement, leading to SQL injection.

The issue arises from the `proid` GET parameter not being properly sanitized, escaped, or validated before being inserted into a SQL statement. This leads to SQL injection.

The issue arises when deleting a date in the plugin, where the `year number` and `month number` POST parameters are not properly sanitized, escaped, or validated before being used in a SQL statement, leading to SQL injection.

The issue concerns the `id` GET parameter in one of the Video Embed WordPress plugin's pages, which is accessible via forced browsing. This parameter is not sanitized, validated, or escaped before being used in a SQL statement, allowing low-privilege users, such as subscribers, to perform SQL injection.