WordPress Plugin Organizer plugin <= 10.2.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by zhuxuan wu in WordPress Plugin Plugin Organizer versions = 10.2.4...

CVE-2026-15304

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...

CVE-2026-15304 Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...

CVE-2026-15304

The CVE affects the WordPress plugin Plugin Organizer . The vulnerability exists in versions up to and including 10.2.4 due to insufficient escaping of the PO_plugin_path parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(...

CVE-2026-15304

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...

EUVD-2026-49988

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...

CVE-2026-15304 Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...

PT-2026-65568

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO plugin path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform plugin search function, where esc sql output is passed as the...

CVE-2025-13417

The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks...

WordPress Plugin Organizer plugin < 10.2.4 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Alex Tselevich nos3curity in WordPress Plugin Plugin Organizer versions 10.2.4...

CVE-2025-13417

The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks...

CVE-2025-13417

The Plugin Organizer WordPress plugin versions prior to 10.2.4 are vulnerable to a SQL injection vulnerability. The root cause is the failure to properly sanitize and escape a parameter before utilizing it in a SQL statement. This flaw allows users with subscriber privileges to perform SQL inject...

EUVD-2025-205555

The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks...

CVE-2025-13417 Plugin Organizer < 10.2.4 - Subscriber+ SQLi

The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks...

CVE-2025-13417 Plugin Organizer < 10.2.4 - Subscriber+ SQLi

The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks...

CVE-2025-13417: Undefined Security Weakness

The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks...

WordPress plugin Plugin Organizer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

PT-2025-53696

Name of the Vulnerable Software and Affected Versions Plugin Organizer versions prior to 10.2.4 Description The Plugin Organizer WordPress plugin does not properly sanitize and escape a parameter before using it in a SQL statement. This allows subscribers to potentially execute SQL injection...

CVE-2012-6512

The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to 1 pluginhook.php, 2 page/index.php, 3 page/dir.php 4 page/options.php, 5 page/resize.php, 6 page/upload.php, 7 page/users.php, or 8 page/view.php...