JTL-Connector for WooCommerce vulnerabilities

2 known vulnerabilities in JTL-Connector for WooCommerce from Ntbyk. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  JTL-Connector for WooCommerce: Unrestricted Upload of File with Dangerous Type

  CVE-2026-87855Oct 14, 2026Ntbyk

  The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid c

• 7.5 High severity

  JTL-Connector for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-78193Oct 14, 2026Ntbyk

  The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient