CVE-2026-73346

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

CVE-2026-66658

Subscriber SQL Injection in Reviewer = 3.14.2 versions...

CVE-2026-66472

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

CVE-2026-66478

Unauthenticated SQL Injection in Church Admin = 5.1.1 versions...

CVE-2026-66458

Unauthenticated SQL Injection in RealPress = 1.1.2 versions...

CVE-2026-66436

Unauthenticated SQL Injection in Active Products Tables for WooCommerce = 1.1.1 versions...

CVE-2026-66446

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

CVE-2026-66430

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-61969

Unauthenticated SQL Injection in Listdom = 5.6.0 versions...

CVE-2026-61966

Subscriber SQL Injection in WPJAM Basic = 7.0.1 versions...

CVE-2026-28184

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-28168

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

CVE-2026-28156

Subscriber SQL Injection in Do Lasso = 358 versions...

CVE-2026-28002

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-28142

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-28001

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-27538

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...

EUVD-2026-57917

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-28002 WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...