https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 04:32:05 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-9713 <p>The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the &#39;id&#39; and &#39;table&#39; parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the &#39;id&#39; field is interpolated without quotes into a WHERE clause (numeric context) and &#39;table&#39; is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb-&gt;prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> <p>The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the &#39;id&#39; and &#39;table&#39; parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the &#39;id&#39; field is interpolated without quotes into a WHERE clause (numeric context) and &#39;table&#39; is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb-&gt;prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-9713 https://vulnerability.circl.lu/vuln/ghsa-332v-fh8c-j8r7 <p>The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the &#39;id&#39; and &#39;table&#39; parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the &#39;id&#39; field is interpolated without quotes into a WHERE clause (numeric context) and &#39;table&#39; is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb-&gt;prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> <p>The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the &#39;id&#39; and &#39;table&#39; parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the &#39;id&#39; field is interpolated without quotes into a WHERE clause (numeric context) and &#39;table&#39; is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb-&gt;prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> https://vulnerability.circl.lu/vuln/ghsa-332v-fh8c-j8r7