Contact Form Generator <= 2.5.5 - Cross-Site Scripting

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-15281

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...

CVE-2026-15281 User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...

EUVD-2026-53179

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...

CVE-2026-14872

The CVE affects the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin, specifically versions before 1.5.5. The root cause is improper sanitisation/escaping of a parameter before use in a SQL statement, enabling a SQL Injection. The vulnerability is exploitable by users with a...

CVE-2026-52521

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature...

CVE-2026-18344

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsivethumbnailimagemanagement function, which...

CVE-2026-18344

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsivethumbnailimagemanagement function, which...

EUVD-2026-51794

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsivethumbnailimagemanagement function, which...

CVE-2026-18344 Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsivethumbnailimagemanagement function, which...

CVE-2026-18344

The WordPress plugin Wp Responsive Thumbnail Slider is affected by a Reflected Cross-Site Scripting vulnerability via the 'id' parameter in versions up to but excluding 1.1.53 . Root cause: insufficient input sanitization and output escaping in responsive_thumbnail_image_management() echoes $_GET...

CVE-2026-16087

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2025-69937

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edittype.php endpoint via the Parameter id...

CVE-2026-13395

The CVE-2026-13395 entry concerns the WordPress plugin “Online Scheduling and Appointment Booking System” prior to version 27.8. The underlying issue is that a parameter from unauthenticated front-end booking requests is not properly sanitized or cast before being used in a SQL query, enabling un...

CVE-2025-69934

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembers.php?id=1...

CVE-2025-69941

SourceCodester Tailor Management System 1.0 is affected by a SQL Injection in addmeasurement.php?id=1. the vulnerability arises from unsafe SQL handling in that endpoint, with CVSS v3.1 base metrics indicating a CRITICAL impact (C:High, I:High, A:High) and NETWORK attack vector. No remediation or...

CVE-2025-69941

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1...

CVE-2025-69937

CodeAstro Membership Management System 1.0 contains an SQL Injection vulnerability in the edit_type.php endpoint via the id parameter. CVSS 3.1 base score 9.8 (CRITICAL) with Confidentiality, Integrity, and Availability impacts all High. Exploitation is network-based, requires no authentication, ...

CVE-2025-69931

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembership.php?id=1...

PT-2026-66586

Name of the Vulnerable Software and Affected Versions CodeAstro Membership Management System version 1.0 Description SQL Injection occurs in the 'edit type.php' endpoint through the id parameter. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for...