CVE-2026-54848

HighCVSS 8.3/10Last modified Oct 25, 2026

Description

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data.

This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-201

Affected software

Vendor	Product	Versions
Saad Iqbal	APIExperts Square for WooCommerce	<= 4.7.3

References

https://patchstack.com/database/wordpress/plugin/woosquare/vulnerability/wordpress-apiexperts-square-for-woocommerce-plugin-4-7-3-sensitive-data-exposure-vulnerability?_s_id=cve

Timeline

Published: Jun 25, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-548499.3Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.CVE-2026-54857.8OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux might allow a threat CVE-2026-548506.5Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.CVE-2026-548517.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms CVE-2026-548525.3Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Co CVE-2026-548535.3Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Se CVE-2026-548546.3Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.CVE-2026-548557.1Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.CVE-2026-548569.8Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.CVE-2026-548579.8Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.CVE-2026-548589.8Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.CVE-2026-548599.8Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.