Skip to content
OpenAdvisories

Vendor

daggerhart

3 known vulnerabilities.

Products

OpenID Connect Generic Client 2 Query Wrangler 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-14498

    Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter

    The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp_ajax_qw_form_ajax handl…

    daggerhart Query Wrangler Web / CMS