CVE-2026-24567

CVE-2026-24567 describes a Missing Authorization / Broken Access Control in WordPress plugin “Anything Order by Terms” by briarinc, affecting versions up to and including 1.4.0. Connected sources confirm the flaw is an authorization issue in the anything-order-by-terms component, with patches rec...

CVE-2026-24567 WordPress Anything Order by Terms plugin <= 1.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in briarinc Anything Order by Terms anything-order-by-terms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Anything Order by Terms: from n/a through = 1.4.0...

CVE-2026-24567 WordPress Anything Order by Terms plugin <= 1.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in briarinc Anything Order by Terms anything-order-by-terms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Anything Order by Terms: from n/a through = 1.4.0...

WordPress plugin “Anything Order by Terms” has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application plugin. WordPress...

WordPress Anything Order by Terms plugin <= 1.4.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Anything Order by Terms versions = 1.4.0...

CVE-2021-47811

Grocery Crud 1.6.4 contains a SQL injection vulnerability in the orderby parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the orderby parameter in POST requests to the ajaxlist endpoint to potentially extract or modify database...

CVE-2021-47811

Grocery Crud 1.6.4 contains a SQL injection vulnerability in the orderby parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the orderby parameter in POST requests to the ajaxlist endpoint to potentially extract or modify database...

Grocery Crud security vulnerability

Grocery Crud is an open-source software development tool created by Grocery Crud. Version 1.6.4 of Grocery Crud contains a security vulnerability, which stems from SQL injection in the orderby parameter, potentially allowing for manipulation of database queries...

CVE-2021-47811 Grocery crud 1.6.4 - 'order_by' SQL Injection

Grocery Crud 1.6.4 contains a SQL injection vulnerability in the orderby parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the orderby parameter in POST requests to the ajaxlist endpoint to potentially extract or modify database...

CVE-2021-47811

Grocery Crud 1.6.4 contains a SQL injection vulnerability in the orderby parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the orderby parameter in POST requests to the ajaxlist endpoint to potentially extract or modify database...

CVE-2021-47811

CVE-2021-47811 affects Grocery Crud 1.6.4. A SQL injection exists in the order_by parameter that allows remote attackers to manipulate queries. The vulnerability can be exploited via the order_by[] parameter in POST requests to the ajax_list endpoint, potentially enabling data extraction or modif...

PT-2026-3181

Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order by parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the order by parameter in POST requests to the ajax list endpoint to potentially extract or modify...

WordPress TaxoPress plugin <= 3.40.1 - Authenticated (Contributor+) SQL Injection via ORDER BY Clause vulnerability

Authenticated Contributor+ SQL Injection via ORDER BY Clause vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin TaxoPress versions = 3.40.1...

CVE-2025-14068

The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 0.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-14068

The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 0.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2025-203058

The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 0.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-14068 WPNakama <= 0.6.3 - Unauthenticated SQL Injection via 'order_by' Parameter

The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 0.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

WordPress WPNakama plugin <= 0.6.3 - Unauthenticated SQL Injection via 'order_by' Parameter vulnerability

Unauthenticated SQL Injection via 'orderby' Parameter vulnerability discovered by WordFence in WordPress Plugin WPNakama versions = 0.6.3...

PT-2025-50892

Name of the Vulnerable Software and Affected Versions WPNakama plugin for WordPress versions up to and including 0.6.3 Description The WPNakama plugin for WordPress is susceptible to time-based SQL Injection through the order by parameter. Insufficient escaping of user-supplied input and inadequa...

CVE-2025-13525

The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...