CM Pop-Up banners <= 1.5.10 is vulnerable to SQL Injection vulnerability

The CM Pop-Up banners plugin for WordPress is vulnerable to generic SQL Injection via the getStatistics function in versions up to, and including, 1.5.10 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers , with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The plugin patched the issue by commenting out the function calls to functions that contained vulnerable SQL queries.