CVE-2026-10835

Name of the Vulnerable Software and Affected Versions SALESmanago & Leadoo versions prior to 3.11.3

Description An issue exists where a parameter passed to an AJAX action is not properly sanitized or escaped before being used in a SQL statement. Additionally, the plugin fails to enforce authorization on this action, which allows authenticated users with minimal permissions, such as subscribers, to execute SQL injection attacks. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update to version 3.11.3 or later.