WordPress Productive Commerce plugin < 1.1.54 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by ? in WordPress Plugin Productive Commerce versions 1.1.54...

CVE-2026-109925

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-109925

The Productive Commerce WordPress plugin versions before 1.1.54 are vulnerable to an unauthenticated SQL injection (SQLi). The root cause is the failure to properly sanitise and escape a parameter used within a SQL statement, specifically affecting the Wishlist and Compare Handlers . Attackers ca...

EUVD-2026-119476

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-109925 Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

PT-2026-139907

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-109926

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...

EUVD-2026-107067

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...

CVE-2026-109926 Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...

CVE-2026-109926 Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...

CVE-2026-109926

The Productive Commerce WordPress plugin, in versions prior to 1.1.49 , is vulnerable to unauthorized plugin activation due to a missing capability check in one of its AJAX actions. Because the plugin exposes the required nonce on every admin-area page, any authenticated user , such as a subscrib...

WordPress Productive Commerce plugin < 1.1.49 - Subscriber+ Arbitrary Plugin Activation vulnerability

Subscriber+ Arbitrary Plugin Activation vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Productive Commerce versions 1.1.49...

PT-2026-120462

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...

EUVD-2025-13739

Malicious code in bioql PyPI...

CVE-2025-47657

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Productive Minds Productive Commerce productive-commerce allows SQL Injection.This issue affects Productive Commerce: from n/a through = 1.1.42...

CVE-2025-47657

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Productive Minds Productive Commerce productive-commerce allows SQL Injection.This issue affects Productive Commerce: from n/a through = 1.1.40...

CVE-2025-47657

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Productive Minds Productive Commerce productive-commerce allows SQL Injection.This issue affects Productive Commerce: from n/a through = 1.1.40...

CVE-2025-47657

CVE-2025-47657: SQL Injection in Productive Commerce (WordPress plugin) affecting versions n/a–1.1.22. Public data shows a high-severity, network-exposed vulnerability (CVSS 3.1, base score 9.3) with no exploit details provided and the patch status as Unpatched; no fixed version is listed in the ...

CVE-2025-47657 WordPress Productive Commerce plugin <= 1.1.40 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Productive Minds Productive Commerce productive-commerce allows SQL Injection.This issue affects Productive Commerce: from n/a through = 1.1.40...

CVE-2025-47657 WordPress Productive Commerce <= 1.1.22 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Productive Minds Productive Commerce allows SQL Injection. This issue affects Productive Commerce: from n/a through 1.1.22...