plugin

Optincraft Vulnerabilities

1 known security issue reported for the Optincraft WordPress plugin. Most recent disclosed Jun 5, 2026.

1 medium

Running Optincraft on your site? Check whether your installed version is affected.

OptinCraft <= 1.2.0 - Authenticated (Administrator+) SQL Injection via 'order_by' Parameter

medium

The OptinCraft – Drag & Drop Optins & Popup Builder for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query....

CVSS:: 4.9
Affected:: up to 1.2.0
Fixed in:: 1.2.1
Disclosed:: Jun 5, 2026

CVE-2026-8978 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database