139 matches found
CVE-2026-104953
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...
EUVD-2026-94184
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...
CVE-2026-104953 MPG < 4.2.3 - Editor+ SQLi via Project Import
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...
CVE-2026-104953
The MPG WordPress plugin (versions before 4.2.3 ) is vulnerable to SQL injection due to improper validation of imported project data before it is used in database queries. This flaw allows users with Editor privileges or higher to execute malicious queries and access sensitive information, such a...
CVE-2026-104953 MPG < 4.2.3 - Editor+ SQLi via Project Import
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...
WordPress MPG plugin < 4.2.3 - Editor+ SQLi vulnerability
Editor+ SQLi vulnerability discovered by ieuns in WordPress Plugin MPG versions 4.2.3...
PT-2026-107407
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...
WordPress MPG plugin < 4.2.3 - Editor+ Arbitrary File Read vulnerability
Editor+ Arbitrary File Read vulnerability discovered by ieuns in WordPress Plugin MPG versions 4.2.3...
CVE-2026-103293
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...
CVE-2026-103293 MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...
CVE-2026-103293
The MPG WordPress plugin before version 4.2.3 is vulnerable to an arbitrary file read flaw. The root cause is a failure to validate that a dataset source supplied during project import is a remote URL; instead, the system treats it as a local filesystem path and copies the content into a publicly...
CVE-2026-103293 MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...
EUVD-2026-91933
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...
PT-2026-104519
Name of the Vulnerable Software and Affected Versions MPG WordPress plugin versions prior to 4.2.3 Description Insufficient validation of the dataset source during project import allows users with the Editor role and above to specify a local filesystem path instead of a remote URL. This leads to ...
CVE-2026-103293: Improper Limitation of a Pathname to a Restricted Directory
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...
CVE-2026-97302
Unauthenticated Sensitive Data Exposure in MPG = 4.2.3 versions...
EUVD-2026-89936
Unauthenticated Sensitive Data Exposure in MPG = 4.2.3 versions...
CVE-2026-97302
The WordPress MPG plugin (versions