CVE-2026-16950: Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products

Q: Who can exploit this issue?

The issue can be exploited by unauthenticated attackers. No login or WordPress account is required according to the available information.

Q: Which plugin versions are affected?

Product Shortlist versions through 1.0.4 are affected. The provided information does not identify a fixed version.

Q: What is the vulnerable attack path?

The vulnerable functionality is get_shortlisted_products. A parameter used by that functionality is not properly sanitized and escaped before being included in a SQL statement.

Published Aug 19, 2026

Updated

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Affected Software

1 affected component

WordPress Shortlist plugin<=1.0.4

Event History

Aug 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue can be exploited by unauthenticated attackers. No login or WordPress account is required according to the available information.

Which plugin versions are affected?

Product Shortlist versions through 1.0.4 are affected. The provided information does not identify a fixed version.

What is the vulnerable attack path?

The vulnerable functionality is get_shortlisted_products. A parameter used by that functionality is not properly sanitized and escaped before being included in a SQL statement.