CVE-2026-12965 — Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking
The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated atta…
Published: 2026-08-03 · CVSS: 9.1 · CVSS 3.1
The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7