10400 matches found
CVE-2026-22340
Unauthenticated SQL Injection in WPJobster = 6.3.5 versions...
CVE-2025-59554 WordPress Advanced Ads – Tracking plugin < 3.0.7 - SQL Injection vulnerability
Unauthenticated SQL Injection in Advanced Ads – Tracking 3.0.7 versions...
CVE-2025-59554
The CVE-2025-59554 entry identifies an unauthenticated SQL injection in the WordPress plugin WordPress Advanced Ads – Tracking for versions before 3.0.7. Affected component: Tracking functionality within the Advanced Ads – Tracking plugin. Root cause: improper handling of input in the tracking fe...
CVE-2026-49084 WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in JetEngine 3.8.9.1 versions...
CVE-2026-39596 WordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerability
Unauthenticated SQL Injection in Blocksy Companion Pro 2.1.29 versions...
CVE-2026-22335
The CVE CVE-2026-22335 affects WordPress: WooCommerce Frontend Manager – Ultimate (wc-frontend-manager-ultimate) versions below 6.7.7. It is a SQL Injection vulnerability exploitable by an authenticated subscriber, with a CVSS base score of 8.5 per Patchstack (high impact: confidentiality) and 6....
CVE-2026-12360
The CVE concerns the JetEngine WordPress plugin ≤ 3.8.10.1, where the listing_load_more AJAX endpoint mishandles the filtered_query field. Specifically, meta_query row values are not sanitized before being merged into SQL, and these values are excluded from the HMAC signature check to support fro...
CVE-2026-39438 WordPress ListingPro plugin <= 2.9.10 - SQL Injection vulnerability
Unauthenticated SQL Injection in ListingPro = 2.9.10 versions...
GHSA-C37G-W77Q-M4VP n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes
Impact An authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database...
CVE-2026-52712 WordPress Attendance Manager plugin <= 0.6.2 - SQL Injection vulnerability
Subscriber SQL Injection in Attendance Manager = 0.6.2 versions...
EUVD-2026-37046
Unauthenticated SQL Injection in InPost Gallery = 2.1.4.6 versions...
CVE-2026-8444
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs' parameter of the wpfbfindreviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $POST'curselrevs' raw with no sanitization or type casting, then concatenatin...
PT-2026-49644
Unauthenticated SQL Injection in GEO my WordPress = 4.5.5 versions...
PT-2026-50093
Unauthenticated SQL Injection in ListingPro = 2.9.10 versions...
PT-2026-49626
Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07 Description An authenticated user with module support write permission and access to a credential record can perform time-based blind SQL injection. This occurs because the expires parameter of the share generate...
PT-2026-49637
Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic = 1.1.4 versions...
Exploit for CVE-2026-54597
CVE-2026-54597 — ITFlow Time-Based Blind SQL Injection Seve...
EUVD-2026-36956
Unauthenticated SQL Injection in GeekyBot = 1.2.0 versions...