PT-2026-5080 · WordPress+1 · Vidshop – Shoppable Videos For Woocommerce+1

Athiwat Tiprasaharn + 2 · Published 2026-01-28 · Updated 2026-01-28 · CVE-2026-0702

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VidShop – Shoppable Videos for WooCommerce plugin for WordPress versions up to and including 1.1.4

Description The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries. Specifically, the fields parameter is vulnerable. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

Recommendations Update the VidShop – Shoppable Videos for WooCommerce plugin for WordPress to a version later than 1.1.4.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-0702

Affected Products

Vidshop – Shoppable Videos For Woocommerce

Woocommerce

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-0702 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a61d8d2a-742f-45f1-9146-f733b80ef195?source=cve · Note
• https://twitter.com/RedPacketSec/status/2016616320100417713 · Twitter Post
• https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L297 · Note
• https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/utils/class-query-builder.php#L778 · Note
• https://plugins.trac.wordpress.org/browser/vidshop-for-woocommerce/trunk/includes/rest-api/v1/class-videos-controller.php#L224 · Note
• https://t.me/CVEtracker/43125 · Telegram Post
• https://twitter.com/CVEnew/status/2016444361572278520 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3441106 · Note
• https://t.me/cveNotify/150102 · Telegram Post