CVE-2019-25745

WordPress Plugin Google Review Slider 6.1 SQL Injection via tid

Published Jun 4, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.

Analysis

Technical impact

The vulnerability is a time-based blind SQL injection that allows unauthenticated attackers to inject malicious SQL code through the 'tid' parameter of the Google Review Slider plugin. By sending crafted GET requests to the admin interface, attackers can cause the database to execute arbitrary SQL, which can be used to extract sensitive data. The flaw results in disclosure of confidential information and is identified by CWE-89.

Affected Systems

The issue affects the WordPress plugin Google Review Slider version 6.1, published by jgwhite33. Impacted systems are WordPress installations that have this plugin deployed and have the admin interface exposed.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability. The exploit is likely to be performed via HTTP GET requests to the unprotected admin area, and it does not require authentication. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS score and lack of authentication requirement still pose a serious risk of data theft.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

jgwhite33

Google Review Slider

affected

Version	Status	Constraints
`6.1`	affected	—

No data.

Vendor Product Versions

Jgwhite33

Wp Google Review Slider

Version	Status	Scheme	Platform
`6.1`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Google Review Slider plugin to the latest version where the 'tid' parameter is sanitized or removed.
If an upgrade is not feasible, disable or delete the plugin to eliminate the attack surface.
Configure a web application firewall or access control rules to block malicious queries that contain arbitrary SQL code in the 'tid' parameter or restrict access to the admin interface to trusted IP addresses.

Generated by OpenCVE AI on June 4, 2026 at 14:51 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.262% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://wordpress.org/plugins/wp-google-places-review-slider/
https://www.exploit-db.com/exploits/47567
https://www.vulncheck.com/advisories/wordpress-plugin-google-review-slider-sql-injection-via-tid

History

Jul 28, 2026 2:30 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		10web 10web slider
CPEs		cpe:2.3:a:10web:slider:6.1:::::wordpress::
Vendors & Products		10web 10web slider

Jun 5, 2026 8:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Jgwhite33 Jgwhite33 wp Google Review Slider Wordpress Wordpress wordpress
Vendors & Products		Jgwhite33 Jgwhite33 wp Google Review Slider Wordpress Wordpress wordpress

Jun 4, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 4, 2026 1:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.
Title		WordPress Plugin Google Review Slider 6.1 SQL Injection via tid
Weaknesses		CWE-89
References		https://wordpress.org/plugins/wp-google-places-review-slider/ https://www.exploit-db.com/exploits/47567 https://www.vulncheck.com/advisories/wordpress-plugin-google-review-slider-sql-injection-via-tid
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}` cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}`