CMS Commander <= 2.288 - Authenticated (Custom+) SQL Injection via 'or_blogname' Parameter
high
The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up to, and including, 2.288. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL quer...
- CVSS:
- 8.8
- Affected:
- up to 2.288
- Fix:
- No patched version reported
- Disclosed:
- Mar 20, 2026
CVE-2026-3334 on NVD →
CMS Commander <= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature
high
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the '_cmsc_public_key' in...
- CVSS:
- 8.1
- Affected:
- up to 2.287
- Fixed in:
- 2.288
- Disclosed:
- Jun 19, 2023
CVE-2023-3325 on NVD →
CMS Commander – Manage Multiple Sites Plugin <= 2.21 - PHP Object Injection
high
The CMS Commander – Manage Multiple Sites plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.21 via deserialization of untrusted input in the cmsc_authenticate() function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable...
- CVSS:
- 8.5
- Affected:
- up to 2.22
- Fixed in:
- 2.22
- Disclosed:
- Jun 1, 2016
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database