Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in serpednet SERPed.net serped-net allows SQL Injection.This issue affects SERPed.net: from n/a through <= 4.4.
Published: 2025-01-24
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from improper neutralization of special characters in SQL commands within the SERPed.net WordPress plugin, allowing an attacker to inject arbitrary SQL statements. This flaw can lead to unauthorized reading or alteration of database contents, potentially compromising confidential user data or affecting site integrity.

Affected Systems

Vendors and products impacted are the SERPed.net WordPress plugin, version 4.4 and earlier, used by sites running WordPress.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity, yet the EPSS score of less than 1% suggests a low likelihood of exploitation at present. Although not listed in CISA KEV, the flaw can be triggered via web input fields processed by the plugin, giving attackers an avenue to execute SQL commands when the plugin processes user‑supplied data.

Generated by OpenCVE AI on May 1, 2026 at 18:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the SERPed.net plugin to a version newer than 4.4, which removes the vulnerable code.
  • If an immediate upgrade is not possible, disable or uninstall the plugin to eliminate the attack surface.
  • Apply proper input validation or switch to parameterized queries in any custom code that interacts with the database to mitigate similar injection risks.

Generated by OpenCVE AI on May 1, 2026 at 18:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-3864 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERPed SERPed.net allows SQL Injection. This issue affects SERPed.net: from n/a through 4.4.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERPed SERPed.net allows SQL Injection. This issue affects SERPed.net: from n/a through 4.4. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in serpednet SERPed.net serped-net allows SQL Injection.This issue affects SERPed.net: from n/a through <= 4.4.
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Fri, 24 Jan 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 24 Jan 2025 17:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERPed SERPed.net allows SQL Injection. This issue affects SERPed.net: from n/a through 4.4.
Title WordPress SERPed.net Plugin <= 4.4 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:31.600Z

Reserved: 2025-01-23T14:51:57.435Z

Link: CVE-2025-24669

cve-icon Vulnrichment

Updated: 2025-01-24T18:46:12.608Z

cve-icon NVD

Status : Deferred

Published: 2025-01-24T18:15:40.730

Modified: 2026-06-17T08:59:24.673

Link: CVE-2025-24669

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T18:45:15Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')