CVE-2022-4290

The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, and including, 3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This potentially allows authenticated users with the ability to add or modify terms or tags to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A partial patch became available in version 3.6 and the issue was fully patched in version 3.7.

• CWE-89
• CWE-89

• https://plugins.trac.wordpress.org/browser/cyr3lat/trunk/cyr-to-lat.php?rev=1117224#L69Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c29130-1b42-4edd-ad62-6f635e03ae31?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/cyr3lat/trunk/cyr-to-lat.php?rev=1117224#L69Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c29130-1b42-4edd-ad62-6f635e03ae31?source=cveThird Party Advisory

Published

Oct 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42894A vulnerability has been identified in syngo Dynamics (All v…7.5
• CVE-2022-42895There is an infoleak vulnerability in the Linux kernel's net…6.5
• CVE-2022-42896There are use-after-free vulnerabilities in the Linux kernel…8.8
• CVE-2022-42897Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allo…9.8
• CVE-2022-42898PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1…8.8
• CVE-2022-42899Bentley MicroStation and MicroStation-based applications may…7.8
• CVE-2022-42900Bentley MicroStation and MicroStation-based applications may…7.8
• CVE-2022-42901Bentley MicroStation and MicroStation-based applications may…7.8
• CVE-2022-42902In Linaro Automated Validation Architecture (LAVA) before 20…8.8
• CVE-2022-42903Zoho ManageEngine SupportCenter Plus through 11024 allows lo…3.3
• CVE-2022-42904Zoho ManageEngine ADManager Plus through 7151 allows authent…7.2
• CVE-2022-42905In wolfSSL before 5.5.2, if callback functions are enabled (…9.1