9.1
Critical
CVE-2026-12965 The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action…
Description
The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Super Store Finder WordPress 7.11 | earliest → < 7.11 | 7.11 |