← Back

Amtythumb

amtythumb

Vendor: Amtythumb Project • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-1683
1Amtythumb Project
1Amtythumb
Jun 17, 2026
Jun 8, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL injection and is exploitable by any authenticated user (and no...Show more
The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL injection and is exploitable by any authenticated user (and not just Author+ like the original advisory mention) due to the fact that they can execute shortcodes via an AJAX actionShow less
CVE-2017-17059
1Amtythumb Project
1Amtythumb
May 13, 2026
Nov 29, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php.