CVE-2026-92766

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-92766

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 3.5.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the 'src_by' parameter within the /vitepos/v1/vendor/list REST route. T...

CVE-2026-92766 Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

EUVD-2026-102824

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-92766 Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-109414

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

EUVD-2026-102677

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-109414 Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-109414 Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-109414

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection in all versions up to and including 3.6.1 . The root cause is insufficient escaping of user-supplied parameters and a lack of sufficient preparation on existing SQL queries, specifically re...

CVE-2026-92766: Improper Neutralization of Special Elements used in an SQL Command

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-109414: Improper Neutralization of Special Elements used in an SQL Command

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

WordPress Vitepos SQL Injection Vulnerability

WordPress Vitepos 3.5.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient cleaning and escaping of the srcby parameter, as well as inadequate preparation of existing SQL queries. This could allow unauthenticated attackers to append additional SQL...

WordPress Vitepos SQL Injection Vulnerability

WordPress Vitepos 3.6.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper cleaning of user input for the parameters srcby.val.start / srcby.val.end operator 'bt', and insufficient preparation of existing SQL queries. This leads to blind SQL injections...