CVE-2026-0702

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-07036.4The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwctCVE-2026-07049.1In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field CVE-2026-07056.7Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before bCVE-2026-07075.3A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentCVE-2026-07086.5A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) inpCVE-2026-07097.2Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers withCVE-2026-07108.4A flaw was found in SIPp. A remote attacker could exploit this by sending specially crafted Session Initiation Protocol (SIP) messages durinCVE-2026-07116.8A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.CVE-2026-07146.8A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial LiCVE-2026-07156.8Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An CVE-2026-07164.8A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the mCVE-2026-07175.3The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and