WordPress Plugin Vulnerabilities

Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

Description

The plugin does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

Proof of Concept

Affects Plugins

Plugin icon
music-store
Fixed in 1.4.5

References

CVE
CVE-2026-82304

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
nobody
Submitter
Aleksandar
Verified
Yes
WPVDB ID
0a4d2ffc-a437-430e-a760-d8d7fb388f0c

Timeline

Publicly Published
2026-09-03 (about 2 days ago)
Added
2026-09-03 (about 1 day ago)
Last Updated
2026-09-04 (about 8 hours ago)

Other

Published
Title
Published
2022-04-13
Title
WP Video Gallery <= 1.7.1 - Unauthenticated SQLi
Published
2011-02-08
Title
Cdnvote < 0.4.2 - Multiple SQL Injections
Published
2022-11-14
Title
Chaty < 3.0.3 - Admin+ SQLi
Published
2023-10-30
Title
Image vertical reel scroll slideshow < 9.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
Published
2026-07-08
Title
Simple Business Directory Pro < 15.9.5 - Unauthenticated SQL Injection