Security Advisory

CVE-2026-14238

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-10 06:00:18

Last updated 2026-08-11 14:56:20

Assigner WPScan

CVSS score 4.1

State PUBLISHED

Description

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.

← Browse all CVEs View on cve.org ↗