Critical severity9.8NVD Advisory· Published Oct 10, 2024· Updated Jun 17, 2026

CVE-2024-9796

Description

The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Internet Formation/Wp Advanced Search
cpe:2.3:a:internet-formation:wp-advanced-search:*:*:*:*:*:wordpress:*:*
Range: <3.3.9.2
WordPress/Advanced Woo Searchcpe-rescue
Package: https://wordpress.org/plugins/advanced-woo-search
Advanced Woo Search/Advanced Woo Searchllm-fuzzy
Range: < 3.3.9.2

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/2ddd6839-6bcb-4bb8-97e0-1516b8c2b99b/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000