CMS Commander – Manage Multiple Sites vulnerabilities

2 known vulnerabilities in CMS Commander – Manage Multiple Sites from Thoefter. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  CMS Commander – Manage Multiple Sites: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-3334Mar 21, 2026Thoefter

  The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up to, and including, 2.288. This is due to insufficient escaping on the user supplied parameters

• 9.8 Critical severity

  CMS Commander – Manage Multiple Sites: Insufficient Entropy

  CVE-2023-3325Jun 20, 2023Thoefter

  The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible for unauthenticated