ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Unknown/ELEX WooCommerce Request a Quote (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Unknown/ELEX WooCommerce Request a Quote.
2. 2Review the reported fix. Update Unknown/ELEX WooCommerce Request a Quote to 2.4.1 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 9, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 9, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 9, 2026

Sources and claim methodology

• Source referencewpscan.com

Related CVEs

• Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' ParameterAlso CWE-89
• WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post MetaAlso CWE-89
• Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' ParameterAlso CWE-89
• Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' ParameterAlso CWE-89
• Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and StylesSame generic ecosystem
• Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi EducationSame generic ecosystem