CVE-2026-16092

Name of the Vulnerable Software and Affected Versions Improved Save Button versions prior to 1.2.2

Description An issue exists where authenticated attackers with author-level access and above can perform a second-order SQL Injection. This occurs during the 'Save and Duplicate' action via the meta key Custom Field due to insufficient escaping of user-supplied parameters and lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 1.2.1.