CVE-2026-15304

The CVE affects the WordPress plugin Plugin Organizer . The vulnerability exists in versions up to and including 10.2.4 due to insufficient escaping of the PO_plugin_path parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(...