wpo-HR vulnerabilities and threats

CVE-2026-73185 is a critical unauthenticated SQL Injection vulnerability affecting versions of wpo-HR's NGG Smart Image Search prior to 4.0.0. This flaw allows remote attackers to inject malicious SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity. No patch or remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows Stored XSS.This issue affects NGG Smart Image Search: from n/a through <= 3.4.3.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows SQL Injection.This issue affects NGG Smart Image Search: from n/a through <= 3.4.1.

The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' shortcode in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.