CVE-2026-54809

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue affects GIFT4U: from n/a through 1.0.10.

Score

CVSS 3.1 9.3 Critical

Status

Deferred - audit@patchstack.com

Published

2026-06-17

Last modified

2026-10-26

Weaknesses

CWE-89

Affected products

• Gift4u (Villatheme)

References

• https://patchstack.com/database/wordpress/plugin/gift4u-gift-cards-all-in-one-for-woo/vulnerability/wordpress-gift4u-pl…