PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39441 Naked Cat Plugins (by Webdados) CVE debrief

CVE-2026-39441 is a critical unauthenticated SQL injection vulnerability in Feed KuantoKusta for WooCommerce – Free plugin versions <= 5.3. The vulnerability has a CVSS score of 9.3 and is considered critical. It was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-39441) and last modified on [cveModifiedAt](https://nvd.nist.gov/vuln/detail/CVE-2026-39441).

Vendor
Naked Cat Plugins (by Webdados)
Product
Feed KuantoKusta for WooCommerce – Free
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-15
Advisory published
2026-06-15
Advisory updated
2026-06-15

Who should care

Administrators and users of Feed KuantoKusta for WooCommerce – Free plugin versions <= 5.3 should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

The vulnerability is an unauthenticated SQL injection in Feed KuantoKusta for WooCommerce – Free plugin versions <= 5.3. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L.

Defensive priority

critical

Recommended defensive actions

  • Update Feed KuantoKusta for WooCommerce – Free plugin to a version greater than 5.3.
  • Refer to [ref-4](https://patchstack.com/database/wordpress/plugin/feed-kuantokusta-for-woocommerce/vulnerability/wordpress-feed-kuantokusta-for-woocommerce-free-plugin-5-3-sql-injection-vulnerability?_s_id=cve) for more

Evidence notes

The vulnerability was reported by Patchstack.

Official resources

CVE-2026-39441 was published on 2026-06-15T21:16:42.740Z and last modified on 2026-06-15T21:24:32.790Z.