TI-2026-28520 CVE-2026-39546 · GHSA-97vv-p3gx-fx2f
WordPress MultiLoca plugin <= 4.2.15 - Privilege Escalation vulnerability
Priority LOW 33
Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.
Vulnerabilities
6 records
TI-2025-08298 CVE-2025-9054 · GHSA-c27f-5hwr-hpfq
Missing authorization in Techspawn MultiLoca - WooCommerce Multi Locations Inventory…
Priority MEDIUM 49
The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcm…
TI-2025-22326 CVE-2025-31056 · GHSA-c4jq-c26m-8vfh
WordPress WhatsCart plugin <= 1.1.0 - SQL Injection vulnerability
Priority MEDIUM 46
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce WhatsCart-f…
TI-2025-16522 CVE-2025-22639 · GHSA-3gr4-8q4g-6f4q
WordPress Distance Rate Shipping for WooCommerce plugin <= 1.3.4 - SQL Injection vulnerability
Priority MEDIUM 45
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn Distance Rate Shipping for WooCommerce distance-rate-shipping-for-woocommerce-pro allows Blind SQL Injection…
TI-2024-12384 CVE-2024-13341 · GHSA-7p2q-7f39-m8x7
MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.1.11 - Authenticated (Subscriber+) SQL Injection
Priority LOW 29
The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to SQL Injection via the 'data-id' parameter in all versions up to, and including, 4.1.11 due to insufficient escaping o…
TI-2021-07238 CVE-2021-24959 · GHSA-h8f7-qg7p-xgpg
WP Email Users <= 1.7.6 - Subscriber+ SQL Injection
Priority MEDIUM 42
The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.