{"id":"CVE-2026-82304","title":"The Music Store  WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.","summary":"The Music Store  WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwe":["CWE-89"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82304","references":[{"url":"https://wpscan.com/vulnerability/0a4d2ffc-a437-430e-a760-d8d7fb388f0c/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00324,"epssPercentile":0.25721,"ingestedAt":"2026-09-06T05:50:39.164Z","slug":"CVE-2026-82304","body":"## Overview\n\nThe Music Store  WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8258,"id":"CVE-2026-82304","ts":1788919995118,"field":"cvss","old":null,"new":"8.6"},{"seq":8257,"id":"CVE-2026-82304","ts":1788919995118,"field":"severity","old":"none","new":"high"},{"seq":8067,"id":"CVE-2026-82304","ts":1788919281021,"field":"cvss","old":"8.6","new":null},{"seq":8066,"id":"CVE-2026-82304","ts":1788919281021,"field":"severity","old":"high","new":"none"},{"seq":7876,"id":"CVE-2026-82304","ts":1788916356184,"field":"cvss","old":null,"new":"8.6"},{"seq":7875,"id":"CVE-2026-82304","ts":1788916356184,"field":"severity","old":"none","new":"high"},{"seq":7685,"id":"CVE-2026-82304","ts":1788915297719,"field":"cvss","old":"8.6","new":null},{"seq":7684,"id":"CVE-2026-82304","ts":1788915297719,"field":"severity","old":"high","new":"none"},{"seq":7494,"id":"CVE-2026-82304","ts":1788912716837,"field":"cvss","old":null,"new":"8.6"},{"seq":7493,"id":"CVE-2026-82304","ts":1788912716837,"field":"severity","old":"none","new":"high"},{"seq":7303,"id":"CVE-2026-82304","ts":1788911331652,"field":"cvss","old":"8.6","new":null},{"seq":7302,"id":"CVE-2026-82304","ts":1788911331652,"field":"severity","old":"high","new":"none"},{"seq":7107,"id":"CVE-2026-82304","ts":1788909078468,"field":"cvss","old":null,"new":"8.6"},{"seq":7106,"id":"CVE-2026-82304","ts":1788909078468,"field":"severity","old":"none","new":"high"},{"seq":6919,"id":"CVE-2026-82304","ts":1788907391752,"field":"cvss","old":"8.6","new":null},{"seq":6918,"id":"CVE-2026-82304","ts":1788907391752,"field":"severity","old":"high","new":"none"},{"seq":6721,"id":"CVE-2026-82304","ts":1788905444161,"field":"cvss","old":null,"new":"8.6"},{"seq":6720,"id":"CVE-2026-82304","ts":1788905444161,"field":"severity","old":"none","new":"high"},{"seq":6539,"id":"CVE-2026-82304","ts":1788903459978,"field":"cvss","old":"8.6","new":null},{"seq":6538,"id":"CVE-2026-82304","ts":1788903459978,"field":"severity","old":"high","new":"none"},{"seq":6325,"id":"CVE-2026-82304","ts":1788901810783,"field":"cvss","old":null,"new":"8.6"},{"seq":6324,"id":"CVE-2026-82304","ts":1788901810783,"field":"severity","old":"none","new":"high"},{"seq":6155,"id":"CVE-2026-82304","ts":1788899562376,"field":"cvss","old":"8.6","new":null},{"seq":6154,"id":"CVE-2026-82304","ts":1788899562376,"field":"severity","old":"high","new":"none"},{"seq":6033,"id":"CVE-2026-82304","ts":1788898240498,"field":"cvss","old":null,"new":"8.6"},{"seq":6032,"id":"CVE-2026-82304","ts":1788898240498,"field":"severity","old":"none","new":"high"}]}