WordPress Plugin Vulnerabilities

Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
product-shortlist
No known fix

References

CVE
CVE-2026-16950

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
c1a2635a-9919-460f-b662-e5e3f80d2361

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-17 (about 2 days ago)

Other

Published
Title
Published
2024-02-16
Title
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.2.6 - Unauthenticated SQL Injection
Published
2021-10-07
Title
Post Content XMLRPC <= 1.0 - Admin+ SQL Injections
Published
2022-02-21
Title
Event Manager for WooCommerce < 3.5.8 - Contributor+ SQL Injection
Published
2025-11-07
Title
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI < 3.40.1 - Authenticated (Editor+) SQL Injection
Published
2024-03-28
Title
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.12.9 - Authenticated (Subscriber+) SQL Injection