{"id":"CVE-2025-52820","aliases":["EUVD-2025-24796","GHSA-2983-hvjm-2229"],"status":"published","title":"WordPress WooCommerce Point Of Sale (POS) \u003c= 1.4 - SQL Injection Vulnerability","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) woo-point-of-salepos allows SQL Injection.This issue affects WooCommerce Point Of Sale (POS): from n/a through \u003c= 1.4.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00292,"percentile":0.21942,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2025-08-14T10:33:56Z","modified":"2026-06-17T09:37:06Z","products":[{"vendor":"infosoftplugin","product":"woocommerce point of sale (pos)"}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/woo-point-of-salepos/vulnerability/wordpress-woocommerce-point-of-sale-pos-1-4-sql-injection-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52820"},{"url":"https://patchstack.com/database/wordpress/plugin/woo-point-of-salepos/vulnerability/wordpress-woocommerce-point-of-sale-pos-1-4-sql-injection-vulnerability?_s_id=cve"},{"url":"https://github.com/advisories/GHSA-2983-hvjm-2229"}],"sources":{"cve":[{"id":"CVE-2025-52820","title":"WordPress WooCommerce Point Of Sale (POS) \u003c= 1.4 - SQL Injection Vulnerability","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) woo-point-of-salepos allows SQL Injection.This issue affects WooCommerce Point Of Sale (POS): from n/a through \u003c= 1.4.","status":"published","published":"2025-08-14T10:33:56.543Z","modified":"2026-04-28T16:13:19.695Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:31.309974Z"}],"euvd":[{"id":"EUVD-2025-24796","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) woo-point-of-salepos allows SQL Injection.This issue affects WooCommerce Point Of Sale (POS): from n/a through \u003c= 1.4.","status":"published","published":"2025-08-14T10:33:56Z","modified":"2026-04-28T16:13:19Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T19:05:38.454261Z"}],"ghsa":[{"id":"GHSA-2983-hvjm-2229","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) allows SQL Injection. This issue affects WooCommerce Point Of Sale (POS): from n/a through 1.4.","status":"published","published":"2025-08-14T12:30:25Z","modified":"2025-08-14T12:30:34Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:03:17.345755Z"}],"nvd":[{"id":"CVE-2025-52820","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) woo-point-of-salepos allows SQL Injection.This issue affects WooCommerce Point Of Sale (POS): from n/a through \u003c= 1.4.","status":"published","published":"2025-08-14T11:15:44.38Z","modified":"2026-06-17T09:37:06.843Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:11:23.594522Z"}]}}