CVE-2026-105076
HighCVSS 7.6Summary
The Vitepos plugin (by Appsbd) up to version 3.6.1 contains a Blind SQL Injection vulnerability that allows an attacker to manipulate database queries.
Risk Assessment
An attacker could exploit the vulnerability to gain unauthorized access to data, modify or delete it, potentially compromising system integrity.
Recommendation
Update the Vitepos plugin to a version newer than 3.6.1 that includes a fix for the SQL injection vulnerability.
Other vulnerabilities in Vitepos
See all- CVE-2026-96815High
Vulnerability in Vitepos plugin up to version 3.5.0 allows privilege escalation through a custom user role.
- CVE-2026-54841High
Versions of Vitepos up to 3.4.2 have a vulnerability that allows unauthorized access to sensitive data.
- CVE-2026-57385High
The Vitepos WordPress plugin contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 3.4.2.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS