CVE-2026-15258

HighCVSS 8.1

Published: 31/07/2026(UTC)Updated: 26/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The Product Feed Manager For WooCommerce WordPress plugin before version 7.6.1 does not properly sanitize and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

Risk Assessment

The risk is that users with Contributor role can execute arbitrary SQL queries, potentially leading to data leakage, database modification, or privilege escalation.

Recommendation

Update the Product Feed Manager For WooCommerce plugin to version 7.6.1 or later.

Other vulnerabilities in Product Feed Manager For WooCommerce

CVE-2026-15306Medium
The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' search parameter in all versions up to and including 7.6.1. This is due to insufficient input sanitization and output escaping.

Original NVD description (English source)

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.