Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · vitepos-lite
Vitepos
13 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 16, 2026Vitepos – Point of Sale (POS) for WooCommerce: Generic SQL InjectionCVE-2026-92766 · affects up to 3.5.1 · reported by WordfenceHigh 7.5
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This makes it possible for unauthenticated attackers, or authenticated attackers holding any POS role (such as vtpos-cashier), to exploit the vulnerability, as the /vitepos/v1/vendor/list REST route's permission callback requires only a POS role assignment rather than any elevated WordPress capability.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Vitepos – Point of Sale (POS) for WooCommerce: Blind SQL InjectionCVE-2026-109414 · affects up to 3.6.1 · reported by WordfenceMedium 6.5
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is an incomplete fix for a previously patched SQL injection (version 3.6.0), which addressed only the gt/lt/le/ge operators while leaving the 'bt' (BETWEEN) operator branch unpatched.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 8, 2026Vitepos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-105076 · affects up to 3.6.1 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1.
Sep 30, 2026Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.CVE-2026-96815 · affects up to 3.5.0 · reported by PatchstackHigh 7.2
Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.
Aug 10, 2026vitepos: Does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpointsCVE-2026-14238 · fixed in 3.6.0 · reported by WPScanMedium 4.1
The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.
Jul 13, 2026Vitepos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57385 · affects up to 3.4.2 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through <= 3.4.2.
Jun 25, 2026Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.CVE-2026-54841 · affects up to 3.4.2 · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.
Jun 22, 2026Vitepos: Does not properly restrict the roles that can be assignedCVE-2026-8157 · fixed in 3.4.2 · reported by WPScanHigh 8.8
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.
Nov 21, 2025Vitepos – Point of Sale (POS) for WooCommerce: Arbitrary file uploadsCVE-2025-13156 · affects up to 3.3.0 · reported by WordfenceHigh 8.8
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible.
Apr 17, 2025Vitepos: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-39535 · affects up to 3.1.7 · reported by PatchstackHigh 7.2
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.7.
Apr 1, 2025Vitepos: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-22277 · affects up to 3.1.4 · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.
Feb 22, 2025Vitepos: Missing AuthorizationCVE-2025-26750 · affects up to 3.1.3 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vitepos: from n/a through <= 3.1.3.
May 8, 2024Vitepos: Missing AuthorizationCVE-2024-33574 · affects up to 3.0.1 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in appsbd Vitepos.This issue affects Vitepos: from n/a through 3.0.1.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.