CVE-2026-15304

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...

CVE-2026-15304 Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...

PT-2026-65568

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO plugin path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform plugin search function, where esc sql output is passed as the...

WordPress Plugin Organizer plugin < 10.2.4 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Alex Tselevich nos3curity in WordPress Plugin Plugin Organizer versions 10.2.4...