CVE-2026-0702

Name of the Vulnerable Software and Affected Versions VidShop – Shoppable Videos for WooCommerce plugin for WordPress versions up to and including 1.1.4

Description The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries. Specifically, the fields parameter is vulnerable. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

Recommendations Update the VidShop – Shoppable Videos for WooCommerce plugin for WordPress to a version later than 1.1.4.