CVE-2026-104753 Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...

EUVD-2026-96087

The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-104023

The Smart Popup by Supsystic plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.13.2 . The flaw exists in the 'sidx' parameter due to insufficient escaping of user-supplied input and a lack of proper SQL query preparation. This allows authenticated attackers...

CVE-2026-104023 Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter

The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-104724

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

CVE-2026-104724

The FireBox – WooCommerce Popup Builder plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 3.1.13 . The root cause is insufficient escaping on user-supplied parameters and a lack of sufficient preparation on existing SQL queries within the FireBox Fo...

EUVD-2026-96066

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

CVE-2026-104724 FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

EUVD-2026-96025

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...

CVE-2026-108474

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...

CVE-2026-108474: Improper Neutralization of Special Elements used in an SQL Command

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...

CVE-2026-107712: Improper Neutralization of Special Elements used in an SQL Command

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-87781: Improper Neutralization of Special Elements used in an SQL Command

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-42633: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Events Manager = 7.4.6 versions...

PT-2026-109787

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.3 Description An SQL Injection issue exists that allows an administrator to execute malicious SQL queries. This occurs when the application fails to properly sanitize input used in database queries...

CVE-2026-42717: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Leyka = 3.32.3 versions...

CVE-2026-62117: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...

PT-2026-109766

Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.7 Description An issue exists that allows a user with subscriber privileges to perform SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially...

PT-2026-109780

Name of the Vulnerable Software and Affected Versions Leyka versions prior to 3.32.4 Description An SQL Injection issue exists in the administrator section, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update to a version newer than...

PT-2026-109777

Name of the Vulnerable Software and Affected Versions Qode Tours versions prior to 3.1.3.3 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database...