WordPress Plugin Vulnerabilities

Content Views < 4.5 - Subscriber+ SQL Injection via preview_request

Description

The plugin does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
content-views-query-and-display-post-page
Fixed in 4.5

References

CVE
CVE-2026-15361

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
7.7 (high)

Miscellaneous

Original Researcher
Jakub Herman
Submitter
Jakub Herman
Submitter website
https://www.jakubherman.net
Verified
Yes
WPVDB ID
3fa62b23-a0a7-4b42-b8dd-0eb6e01972b2

Timeline

Publicly Published
2026-08-03 (about 25 days ago)
Added
2026-08-03 (about 25 days ago)
Last Updated
2026-08-27 (about 14 hours ago)

Other

Published
Title
Published
2025-03-24
Title
Web Directory Free < 1.7.7 - Unauthenticated SQL Injection
Published
2024-02-09
Title
RSS Aggregator by Feedzy < 4.4.3 - Authenticated(Contributor+) SQL Injection
Published
2026-08-18
Title
Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons < 1.4.3 - Unauthenticated SQL Injection
Published
2025-06-05
Title
WP Text Expander <= 1.0.1 - Authenticated (Administrator+) SQL Injection
Published
2026-07-10
Title
Catalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid Parameter