Skip to content
Sign in
4.1 Medium

CVE-2026-14238 The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body…

Description

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.

Affected products and versions

Product Affected versions Fixed in
Vitepos 3.6 earliest → < 3.6.0 3.6.0

Other CVEs of Vitepos

The 3 CVEs of Vitepos →
CVE-2026-14237 The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target… 7.2 High CVE-2026-8157 The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new… 8.8 High
Track this CVE