CVE-2026-66628
HighCVSS 7.6Summary
The WP-Lister Lite for eBay plugin in versions up to and including 3.8.11 contains a Shop manager SQL Injection vulnerability. This allows a shop manager-level user to inject malicious SQL code into database queries.
Risk Assessment
A user with shop manager privileges could execute arbitrary SQL queries, risking data leakage, modification, or deletion from the WordPress database.
Recommendation
Update the WP-Lister Lite for eBay plugin to a version newer than 3.8.11 as soon as a fix is available, and review the permissions assigned to shop manager roles.
Other vulnerabilities in WP-Lister Lite for eBay
See all- CVE-2026-18595High
The WP-Lister Lite for eBay plugin for WordPress in all versions up to and including 3.8.9 is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.
- CVE-2026-11973Medium
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to and including 3.8.8. This is due to insufficient escaping and lack of preparation on the SQL query. Authenticated attackers with shop manager-level access or above can append additional SQL queries to extract sensitive information from the database.
Original NVD description (English source)
Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.