VidShop for WooCommerce <= 1.1.4 - SQL Injection

VidShop – Shoppable Videos for WooCommerce plugin for WordPress = 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-0702 info: name: VidShop for WooCommerce =...

WordPress Media Sweep plugin <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'fields' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Media Sweep – WordPress Media Cleaner versions = 1.1.3...

CVE-2026-77824

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

EUVD-2026-65459

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-77824 Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-77824 Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-77824

Media Sweep – WordPress Media Cleaner (all versions up to and including 1.1.3 ) is affected by a SQL Injection vulnerability in the 'fields' parameter of its REST API. The root cause is insufficient escaping of the user-supplied parameter combined with lack of proper query preparation, as seen in...

CVE-2026-77824: Improper Neutralization of Special Elements used in an SQL Command

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2026-81273

Name of the Vulnerable Software and Affected Versions Media Sweep – WordPress Media Cleaner versions prior to 1.1.4 Description An issue exists where authenticated attackers with administrator-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of...

CVE-2026-15951

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the...

CVE-2026-15951

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the...

EUVD-2026-51756

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the...

CVE-2026-15951

The Icegram Mailer WordPress plugin (up to version 1.0.12) is vulnerable to SQL Injection via the 'fields' parameter. The root cause is insufficient escaping and lack of prepared statements in Icegram_Mailer_Logs_Table::get_logs(), where each element of the $_REQUEST['data']-supplied fields array...

PT-2026-67086

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the Icegram Mailer Logs...

CVE-2026-15951: Improper Neutralization of Special Elements used in an SQL Command

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the...

CVE-2026-7543

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-7543

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

EUVD-2026-44886

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2026-60450

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-7543: Improper Neutralization of Input During Web Page Generation

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...