CVE Catalog
CVE-2026-16950
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk0.19%
9th percentile - higher than 9% of all known CVEs
Summary
The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Risk Assessment
SQL injection attacks can lead to unauthorized database access, data theft, or full site compromise.
Recommendation
Update the Product Shortlist plugin to the latest available version or apply a security patch.
Original NVD description (English source)
The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.