CVE-2026-10835: Unknown Salesmanago & Leadoo

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as subscribers, to perform SQL injection attacks.

Affected products

• Unknown Salesmanago & Leadoo: before 3.11.3 (fixed in 3.11.3)

Published 2026-06-26. Last modified 2026-06-26.