Critical · 9.3 CVE-2026-39494 EUVD-2026-36360GHSA-hg8f-fjxw-frxj

WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerability

Published Jun 11, 2026 · Updated Jun 12, 2026 · Assigned by Patchstack

Vendor: WBW Plugins Product: Product Filter by WBW

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection.

This issue affects Product Filter by WBW: from n/a through 3.1.2.

Affected products

Vendor	Product	Affected	Fixed
WBW Plugins	Product Filter by WBW	≤ 3.1.2	—

References

https://patchstack.com/database/wordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-3-1-2-sql-injection-vulnerability?_s_id=cve vdb-entry