CVE-2026-15361
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Content Views WordPress plugin before version 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitize attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.
Risk Assessment
An attacker can gain unauthorized access to the database, steal or modify data, potentially leading to full site compromise.
Recommendation
Update the Content Views plugin to the latest patched version. Additionally, restrict user privileges and use prepared statements.
Other vulnerabilities in Content Views WordPress plugin
Original NVD description (English source)
The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS