CVE-2026-66580
HighCVSS 8.5Summary
The WordPress plugin Product Feed Manager in versions up to 7.12.0 contains an SQL Injection vulnerability accessible to users with Contributor privileges. A Contributor can inject malicious SQL queries through a vulnerable parameter.
Risk Assessment
This vulnerability is more severe than cases requiring administrator privileges, as a Contributor account has a lower access threshold and may be easier to obtain. It can lead to leakage or modification of data in the WordPress database.
Recommendation
Update the Product Feed Manager plugin to a version newer than 7.12.0. Verify Contributor account permissions and regularly audit their activity.
Other vulnerabilities in Product Feed Manager
See all- CVE-2026-118093Medium
The Product Feed Manager plugin by WPFunnels Team (up to version 7.14.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-118089High
The WordPress plugin Product Feed Manager in versions up to 7.14.1 contains a PHP Object Injection vulnerability exploitable by a shop manager-level user. This may lead to injection of a malicious PHP object.
- CVE-2026-59553High
Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Product Feed Manager plugin up to version 7.6.1. Allows an attacker to inject malicious scripts.
Original NVD description (English source)
Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS