CVE-2015-10100 Dynamic Widgets Plugin dynwid_class.php sql injection

What is CVE-2015-10100?

CVE-2015-10100 is a medium-severity vulnerability in Dynamic Widgets Plugin, published on 10 Apr 2023.

Official description

A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwid_class.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.11 is able to address this issue. The identifier of the patch is d0a19c6efcdc86d7093b369bc9e29a0629e57795. It is recommended to upgrade the affected component. The identifier VDB-225353 was assigned to this vulnerability.

Weakness: CWE-89

Which versions are affected by CVE-2015-10100?

It affects 1 product.

Products include Vivwebsolutions Dynamic Widgets.

How do I fix CVE-2015-10100?

No fix has been published for CVE-2015-10100 yet. Limit exposure of the affected software until one is available.

Is CVE-2015-10100 being exploited?

There is no known exploitation of CVE-2015-10100 in the wild and no public exploit code.

Other vulnerabilities in Dynamic Widgets Plugin

• CVE-2015-9437 Cross-site request forgery in n/a Medium 6.5
• CVE-2015-9436 Cross-site scripting in n/a Medium 5.4
• CVE-2024-51669 WordPress Dynamic Widgets plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-587p-pvvj-3ghc.