CVE-2025-24612: WordPress Shipping for Nova Poshta plugin <= 1.19.6 - SQL Injection vulnerability
9.3
CVSS
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MORKVA Shipping for Nova Poshta allows SQL Injection. This issue affects Shipping for Nova Poshta: from n/a through 1.19.6.
Classification
CVE ID: CVE-2025-24612
CVSS Base Severity: CRITICAL
CVSS Base Score: 9.3
Affected Products
Vendor: MORKVA
Product: Shipping for Nova Poshta
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.72% (scored less or equal to compared to others)
EPSS Date: 2025-02-25 (when was this score calculated)