Skip to content
OpenAdvisories
High · 8.5 CVE-2026-24552 EUVD-2026-48144GHSA-9299-rf7x-c527

WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability

Published Jul 23, 2026 · Updated Sep 21, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3.

Affected products

VendorProductAffectedFixed
John-Michael L'Allier Create ≤ 2.5.3 —

References