CVE-2026-16080

Name of the Vulnerable Software and Affected Versions Image Uploader for Welcart versions prior to 1.4.7

Description The Image Uploader for Welcart plugin for WordPress contains a SQL Injection flaw. This occurs because the plugin does not sufficiently escape the post title parameter and fails to properly prepare the associated SQL query. Authenticated attackers with author-level permissions or higher can exploit this by appending malicious SQL queries to existing ones, allowing the extraction of sensitive information from the database.

Recommendations Update the plugin to a version newer than 1.4.6. As a temporary mitigation, restrict user permissions to prevent users with author-level access from modifying the post title parameter.