CVE-2025-22710

CVE-2025-22710 1️⃣ Component type WordPress 플러그인 2️⃣ Component details 구성 요소 이름 WooCommerce Advanced Bulk Edit Products, Orders, Coupons, Any WordPress Post Type – Smart Manager 취약한 버전 ⚠️ true/false 조건에 따른 응답 값의 차이를 확인하려면 게시물이 최소 1개 이상 존재해야 합니다. 1. Smart Manager 플러그인이 설치된 WordPress 사이트를 준비하고, 관리자...

CVE-2024-0566

CVE-2024-0566 Smart Manager 8.27.0 - 인증 후 SQL 인젝션 익스플로잇 제목: Smart Manager 8.27.0 - 인증 후 SQL 인젝션 날짜: 2024-01-18 익스플로잇 작성자: Ivan Spiridonov - xbz0n 공급업체 홈페이지: https://www.storeapps.org/ 소프트웨어 링크: https://www.storeapps.org/product/smart-manager/ 버전: 8.27.0 테스트 환경: Ubuntu 22.04 CVE: CVE-2024-0566 SQL...

CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

EUVD-2026-91963

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-18443 Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress (versions up to and including 8.97.0 ) is vulnerable to SQL Injection via the 'access_privileges' parameter. The root cause is insufficient escaping of user-supplied input and a lack of sufficient prepa...

WordPress Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) plugin <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation vulnerability

Authenticated Subscriber+ SQL Injection to Privilege Escalation vulnerability discovered by lhking in WordPress Plugin Smart Manager versions = 8.97.0...

CVE-2026-14203

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

CVE-2026-14203

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

WordPress Smart Manager plugin < 8.92.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by TruongLV1 From FPT Nightwolf in WordPress Plugin Smart Manager versions 8.92.0...

CVE-2026-14203 Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

CVE-2026-14203 Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

CVE-2026-14203

The Smart Manager WordPress plugin, in versions before 8.92.0 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper encoding of a post field before it is rendered into an HTML attribute within the plugin's management grid. This allows users with Contributor p...

PT-2026-64845

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

CVE-2026-14203: Improper Neutralization of Input During Web Page Generation

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

CVE-2026-57704

Unauthenticated Cross Site Scripting XSS in Smart Manager = 8.90.0 versions...

CVE-2026-57704 WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Smart Manager = 8.90.0 versions...

EUVD-2026-48175

Unauthenticated Cross Site Scripting XSS in Smart Manager = 8.90.0 versions...

CVE-2026-57704

CVE-2026-57704 : Unauthenticated Cross Site Scripting (XSS) in the WordPress Smart Manager plugin for WP e‑commerce, versions ≤ 8.90.0. Root cause and specific exploit path are not detailed in the provided documents. CVSSv3.1 base score 7.1 (HIGH) with network attack vector and user interaction r...

CVE-2026-57704 WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Smart Manager = 8.90.0 versions...