Input validation vulnerability in Plg Novana *

The Plg Novana plugin for WordPress has a security vulnerability that makes it possible for unauthenticated attackers to gain access to sensitive information from the database. The vulnerability exists because the plugin does not properly escape user supplied parameters and does not prepare existing SQL queries enough. This leaves the plugin open to something called generic SQL Injection, which occurs when an attacker adds extra SQL queries to existing queries.