PT-2026-109534

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

PT-2026-109506

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...

PT-2026-109500

The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2026-109553

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

PT-2026-109606

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display name' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

PT-2026-109798

Name of the Vulnerable Software and Affected Versions uListing versions prior to 2.2.1 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database,...

PT-2026-109700

Name of the Vulnerable Software and Affected Versions Tickera tickera-event-ticketing-system versions prior to 3.6.0.6 Description An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the...

PT-2026-109756

Name of the Vulnerable Software and Affected Versions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes versions prior to 1.5.4 Description A SQL Injection issue exists that allows a user with subscriber privileges to execute unauthorized database queries. Recommendations Update...

CVE-2026-104753: Improper Neutralization of Special Elements used in an SQL Command

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-104724: Improper Neutralization of Special Elements used in an SQL Command

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

CVE-2026-62031: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in uListing = 2.2.0 versions...

CVE-2026-45440: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...

CVE-2026-42717: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Leyka = 3.32.3 versions...

CVE-2026-42712: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Qode Tours = 3.1.3.2 versions...

CVE-2026-42633: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Events Manager = 7.4.6 versions...

CVE-2026-40800: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes = 1.5.3 versions...

CVE-2026-108604: Incorrect Authorization

Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...

CVE-2026-105889: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6...

CVE-2026-87781: Improper Neutralization of Special Elements used in an SQL Command

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-107712: Improper Neutralization of Special Elements used in an SQL Command

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...