CVE-2025-10045

Name of the Vulnerable Software and Affected Versions onOffice for WP-Websites plugin versions up to and including 5.7

Description The onOffice for WP-Websites plugin for WordPress is susceptible to SQL Injection due to inadequate input sanitization and query preparation. Specifically, the order parameter is not properly escaped, allowing authenticated attackers with Editor-level access or higher to inject additional SQL queries. This can lead to the extraction of sensitive information from the database. The vulnerable parameter is order.

Recommendations Update the onOffice for WP-Websites plugin to a version newer than 5.7.