Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) woo-point-of-salepos allows SQL Injection.This issue affects WooCommerce Point Of Sale (POS): from n/a through <= 1.4.
Published: 2025-08-14
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an SQL injection flaw caused by improper neutralization of special elements in an SQL command in the WooCommerce Point Of Sale (POS) WordPress plugin. Based on the description, this flaw allows an attacker to inject malicious SQL code, which can lead to unauthorized data extraction, database alteration, or escalation of privileges depending on the underlying database permissions.

Affected Systems

The flaw affects all releases of the WooCommerce Point Of Sale (POS) plugin by infosoftplugin up to and including version 1.4. All WordPress sites installing this plugin are potentially exposed unless a newer, patched release is used.

Risk and Exploitability

The CVSS score of 8.5 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates a low probability of current exploitation in the wild, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves sending crafted HTTP requests containing malicious input to the plugin, assuming the site is reachable and the database is accessible via the plugin.

Generated by OpenCVE AI on April 30, 2026 at 16:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the WooCommerce Point Of Sale (POS) plugin to a version newer than 1.4 where the issue has been corrected.
  • If an upgrade is not possible, disable or uninstall the plugin to remove the vulnerability.
  • Apply least‑privilege to the database account used by WordPress for the plugin, restricting permissions to only those necessary for normal operation.

Generated by OpenCVE AI on April 30, 2026 at 16:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-24796 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) allows SQL Injection. This issue affects WooCommerce Point Of Sale (POS): from n/a through 1.4.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) allows SQL Injection. This issue affects WooCommerce Point Of Sale (POS): from n/a through 1.4. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) woo-point-of-salepos allows SQL Injection.This issue affects WooCommerce Point Of Sale (POS): from n/a through <= 1.4.
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Sat, 16 Aug 2025 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Infosoftplugin
Infosoftplugin woocommerce Point Of Sale
Woocommerce
Woocommerce woocommerce
Wordpress
Wordpress wordpress
Vendors & Products Infosoftplugin
Infosoftplugin woocommerce Point Of Sale
Woocommerce
Woocommerce woocommerce
Wordpress
Wordpress wordpress

Thu, 14 Aug 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 14 Aug 2025 10:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) allows SQL Injection. This issue affects WooCommerce Point Of Sale (POS): from n/a through 1.4.
Title WordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection Vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Infosoftplugin Woocommerce Point Of Sale
Woocommerce Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:19.695Z

Reserved: 2025-06-19T10:03:43.798Z

Link: CVE-2025-52820

cve-icon Vulnrichment

Updated: 2025-08-14T13:34:38.039Z

cve-icon NVD

Status : Deferred

Published: 2025-08-14T11:15:44.380

Modified: 2026-04-23T15:32:14.153

Link: CVE-2025-52820

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T16:45:26Z

Weaknesses