CVE-2026-16146

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation...

CVE-2026-16586

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...

CVE-2026-15993

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

CVE-2026-16094

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-15453

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-16146

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation...

EUVD-2026-58862

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation...

CVE-2026-15453

CVE-2026-15453 affects the KiviCare – Clinic & Patient Management System (EHR) WordPress plugin. The issue is a generic SQL Injection in the internal searchTerm parameter across all versions up to 4.5.1, caused by insufficient escaping and lack of proper query preparation. This allows authenticat...

EUVD-2026-58860

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-15453 KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-15453

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-16094

The CVE-2026-16094 entry concerns the WordPress plugin “Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms.” All versions up to 5.1 are affected by a generic SQL Injection via the 'key' parameter, caused by insufficient escaping of user input and lack of proper SQL query preparat...

EUVD-2026-58859

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-16586 Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...

CVE-2026-16586

CVE-2026-16586 affects the WordPress plugin “Contest Gallery” (all versions up to 30.0.7). It describes a Second-Order SQL Injection via the parameter cgRealId in the function path cg_multiple_files_for_post , caused by insufficient escaping of user input and lack of proper SQL query preparation....

CVE-2026-18387 Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tagquery' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-16080

CVE-2026-16080 affects the WordPress plugin “Image Uploader for Welcart” (authenticated scenario). The vulnerability is a generic SQL injection in the attachment field post_title for versions up to 1.4.6, caused by insufficient escaping of user input and lack of proper query preparation. Impact d...

CVE-2026-16080 Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter

The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

EUVD-2026-58834

The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

PT-2026-73043

Name of the Vulnerable Software and Affected Versions SourceCodester Online Clothing Store version 1.0 Description An issue exists within the SQL Database Backup component, specifically affecting the /db/shopping.sql file. This flaw allows remote attackers to access files or directories through...