Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-14237

Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Vitepos Wordpress
Products
Vitepos Wordpress
CVE-2026-14238

Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Vitepos Wordpress
Products
Vitepos Wordpress
CVE-2026-8157

Vitepos < 3.4.2 - Outlet Manager+ Privilege Escalation

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Vitepos Wordpress
Products
Vitepos Wordpress