Inet Webkit Vulnerabilities

The iNET Webkit plugin for WordPress is vulnerable to SQL Injection in versions up to 1.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append add...

CVSS:

6.5

Affected:

1.2.4 – 1.2.4

Fix:

No patched version reported

Disclosed:

Jul 2, 2026

CVE-2026-57752 on NVD →

[en] Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iNET Webkit: from n/a through <= 1.2.4.

Affected:

up to 1.2.4

Fix:

No patched version reported

Disclosed:

Jan 23, 2026

CVE-2026-24566 on NVD →

The iNET Webkit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.2.4

Fix:

No patched version reported

Disclosed:

Jan 21, 2026

CVE-2026-24566 on NVD →

[en] Missing Authorization vulnerability in iNET iNET Webkit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iNET Webkit: from n/a through 1.2.2.

Affected:

up to 1.2.3

Fixed in:

1.2.3

Disclosed:

Mar 27, 2025

CVE-2025-22629 on NVD →

The iNET Webkit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.2.2

Fixed in:

1.2.3

Disclosed:

Feb 11, 2025

CVE-2025-22629 on NVD →