Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-12965

Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Super Store Finder WordPress

Default version status: unaffected

  • 0 to < 7.11affected

References