CVE-2026-87767

Name of the Vulnerable Software and Affected Versions wp shortcut link and advertisement baner WordPress plugin versions prior to 1.2.1

Description An issue exists where a parameter is not sanitized or escaped before being used in a SQL query within an AJAX action accessible to unauthenticated users. This allows unauthenticated attackers to perform SQL injection attacks to extract sensitive data from the database via the url parameter.

Recommendations Update the plugin to a version later than 1.2.0. Avoid using the url parameter in the affected AJAX action until the update is applied.