GCVE - cpe:2.3:a:labelblanc:improved_save

Approved changes feed: RSS · Atom

cpe:2.3:a:labelblanc:improved_save_button:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Labelblanc (`aea72c40-fefb-5586-a63a-94cf8da2b3f1`)
Product	Improved Save Button (`4ebff17e-3e51-5792-bc45-11072e71720b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-16092`	vulnerable	2026-09-16 04:32:56.550300	Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter MEDIUM (6.5) The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'meta_key' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Published: 2026-07-30T03:03:21.282Z Updated: 2026-07-30T13:58:36.670Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/a1dbc2ca-eb3f-4c0f-a5c0-28579f694237?source=cve https://plugins.trac.wordpress.org/browser/improved-save-button/tags/1.2.1/actions/class-lb-save-and-then-action-duplicate.php#L179 https://plugins.trac.wordpress.org/browser/improved-save-button/tags/1.2.1/actions/class-lb-save-and-then-action-duplicate.php#L173 https://plugins.trac.wordpress.org/browser/improved-save-button/tags/1.2.1/lib/class-lb-save-and-then-post-save.php#L86	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.