The Pixelating image slideshow gallery plugin contains an SQL Injection flaw due to improper handling of special characters in user supplied data, identified as CWE‑89. An attacker who can supply crafted input can cause the plugin to execute unintended SQL commands, potentially retrieving, modifying, or deleting database contents. This could lead to data exfiltration or unauthorized data manipulation.

All installations of gopiplus Pixelating image slideshow gallery on WordPress that are version 8.0 or earlier are affected. The vulnerability exists in every release up to and including 8.0; newer releases may have addressed the issue.

The CVSS score of 8.5 indicates a high severity. The EPSS score of less than 1% suggests a low current exploitation probability, and the issue is not listed in CISA KEV. The attack likely requires the ability to submit data to the plugin’s input points, which may be accessible to authenticated editors or visitors depending on the WordPress configuration. Without a patch or WAF, an attacker could exploit this flaw by sending malformed requests to the plugin’s endpoints.