PT-2026-52665 · Undefined · Undefined
Published
2026-06-26
·
Updated
2026-06-26
·
CVE-2026-10835
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as subscribers, to perform SQL injection attacks.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined