CVE-2026-16950 PUBLISHED

Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products

Assigner: WPScan
Reserved: 24.07.2026 Published: 19.08.2026 Updated: 19.08.2026

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Product Status

Vendor Unknown
Product Product Shortlist
Versions Default: unknown
  • affected from 0 to 1.0.4 (incl.)

Credits

  • João Ramos Maciel finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE