CVE-2026-6295

WP Optimizer (WordPress plugin) is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0 . The root cause is an unsafe subquery-detection branch in the Query::parse_key_compare_field() method: when a user-supplied value matches the regex ^[(\s]*SELECT\s+, it ...

EUVD-2026-83544

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...

CVE-2026-13191 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13191

The Create plugin for WordPress (by MediaVine ) is affected by a generic SQL injection in the order_by parameter, present in all versions up to and including 2.5.3 . The root cause is insufficient escaping of the user-supplied parameter combined with lack of proper preparation of the existing SQL...

EUVD-2026-83543

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13191 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-6295 WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...

CVE-2026-88926

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-88926 VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-83508

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-88926 VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-88926

The VikRentItems Flexible Rental Management System WordPress plugin, in versions before 1.2.4 , is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitise and escape certain parameters before including them in SQL statements. This allows remote, u...

Linux Distros Unpatched Vulnerability : CVE-2026-61819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pgjobmon is installed and partconfig.jobmon is true,...

Linux Distros Unpatched Vulnerability : CVE-2026-61820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherittemplateproperties manually surrounds primary-key colu...

Linux Distros Unpatched Vulnerability : CVE-2026-61781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, createpartitiontime reads the writable partconfig.timeencoder...

Linux Distros Unpatched Vulnerability : CVE-2026-61818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undopartition reads partconfig.timeencoder as unrestricted te...

PT-2026-95790

Name of the Vulnerable Software and Affected Versions WP Optimizer versions prior to 2.5.1 Description Authenticated attackers with administrator-level access can perform SQL Injection through the 's' parameter. The issue occurs in the parse key compare field function of the Query class, where a...

PT-2026-95775

Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4 Description An issue exists where authenticated attackers with author-level access or higher can perform a SQL Injection. This occurs because the order by parameter is not sufficiently escape...

PT-2026-95761

Name of the Vulnerable Software and Affected Versions VikRentItems Flexible Rental Management System WordPress plugin versions prior to 1.2.4 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize and escape certain parameters before incorporating...

CVE-2026-75959: Improper Neutralization of Special Elements used in an SQL Command

The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'logtablefilter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...