Appsbd vulnerabilities
Published CVEs affecting Appsbd products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-105076
High · 7.6
CWE-89 Oct 8, 2026
WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1.
CVE-2026-54841
High · 7.5
CWE-201 Jun 25, 2026
WordPress Vitepos plugin <= 3.4.2 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.
CVE-2025-13156
High · 8.8
CWE-434 Nov 21, 2025
Vitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible.