CVE-2026-103355: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Khanh Nguyen in WordPress Plugin WP BASE Booking versions = 6.4.0...

WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Seongwon LEE in WordPress Plugin EduAdmin Booking versions 6.0.0...

WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin Ajax Search Pro versions = 4.29.1...

WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin tagDiv Opt-In Builder versions = 1.7.6...

WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin tagDiv Opt-In Builder versions = 1.7.6...

WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability

WordPress JNews - Pay Writer plugin = 12.0.1 - SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin JNews - Pay Writer versions = 12.0.1...

WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Heinrihs Skrodelis in WordPress Plugin Taskbuilder versions = 6.0.5...

WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Khanh Nguyen in WordPress Plugin WP BASE Booking versions = 6.4.0...

web-vulnerability-scanner

vulnerabilityscanner VulnRadar – An intera...

Exploit for CVE-2026-48842

POC-CVE-2...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.186 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Samuele Santonicola in WordPress Plugin GeoDirectory versions = 2.8.186...

CVE-2026-96267

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress (versions up to and including 8.97.0 ) is vulnerable to SQL Injection via the 'access_privileges' parameter. The root cause is insufficient escaping of user-supplied input and a lack of sufficient prepa...

EUVD-2026-91963

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-18443 Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-18443 Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-96267 WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...