title: MAZ Loader < 1.3.3 - Contributor+ SQL Injection
description: The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection.
problem types: CWE-89 SQL Injection
affected:
{
product: MAZ Loader – Preloader Builder for WordPress
vendor: Unknown
versions:
lessThan: 1.3.3, status: affected, version: 1.3.3, versionType: custom
}