title: Slider Hero < 8.2.7 - Contributor+ SQL Injection
description: The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
problem types: CWE-89 SQL Injection
affected:
{
product: Slider Hero with Animation, Video Background & Intro Maker
vendor: Unknown
versions:
lessThan: 8.2.7, status: affected, version: 8.2.7, versionType: custom
}