CVE

CVE-2022-3254

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection

Attack Vector

Network

Privileges Req.

None

User Interaction

None

wordpress classifieds plugin – ad directory & listings by awp classifieds

Updated Sep 18, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

AWP Classifieds <= 4.2.1 - Unauthenticated SQL Injection

WordPress Classifieds Plugin before 4.3 contains a SQL injection caused by improper sanitization and escaping of parameters in an AJAX action, letting unauthenticated attackers execute arbitrary SQL commands, exploit requires the premium module to be active. References: https://nvd.nist.gov/vuln/detail/CVE-2022-3254 https://wpscan.com/vulnerability/546c47c2-5b4b-46db-b754-c6b43aef2660 Remediation: Update to version 4.3 or later.

Used 2.4k times · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: wordpress classifieds plugin – ad directory & listings by awp classifieds

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →