96 matches found
CVE-2025-22710
CVE-2025-22710 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WooCommerce Advanced Bulk Edit Products, Orders, Coupons, Any WordPress Post Type – Smart Manager Vulnerable version ⚠️ At least one post must exist to observe the difference in response values based on...
CVE-2024-0566
CVE-2024-0566 Smart Manager 8.27.0 - Inyección SQL Post-Autenticada Título del Exploit: Smart Manager 8.27.0 - Inyección SQL Post-Autenticada Fecha: 2024-01-18 Autor del Exploit: Ivan Spiridonov - xbz0n Página del Proveedor: https://www.storeapps.org/ Enlace del Software:...
CVE-2026-18443
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...
CVE-2026-18443
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress (versions up to and including 8.97.0 ) is vulnerable to SQL Injection via the 'access_privileges' parameter. The root cause is insufficient escaping of user-supplied input and a lack of sufficient prepa...
EUVD-2026-91963
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...
CVE-2026-18443 Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...
CVE-2026-18443 Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...
PT-2026-104542
Name of the Vulnerable Software and Affected Versions The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management versions prior to 8.97.1 Description An issue exists where authenticated attackers with subscriber-level access and above can perform a generic SQL Injection. This occur...
CVE-2026-18443: Improper Neutralization of Special Elements used in an SQL Command
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...
WordPress Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) plugin <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation vulnerability
Authenticated Subscriber+ SQL Injection to Privilege Escalation vulnerability discovered by lhking in WordPress Plugin Smart Manager versions = 8.97.0...
CVE-2026-14203
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...
WordPress Smart Manager plugin < 8.92.0 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by TruongLV1 From FPT Nightwolf in WordPress Plugin Smart Manager versions 8.92.0...
CVE-2026-14203 Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...
CVE-2026-14203 Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...
CVE-2026-14203
The Smart Manager WordPress plugin, in versions before 8.92.0 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper encoding of a post field before it is rendered into an HTML attribute within the plugin's management grid. This allows users with Contributor p...
CVE-2026-14203
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...
CVE-2026-14203: Improper Neutralization of Input During Web Page Generation
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...
PT-2026-64845
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...