Exploit for SQL Injection in Wordpress

wpsqli - WordPress SQLi Extractor CVE-2026-60137 A fast,...

CVE-2026-18592

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

WordPress Simple Personal Message plugin <= 1.0.3 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Lenon Leite in WordPress Plugin Single Personal Message versions = 1.0.3...

WordPress apptha-slider-gallery plugin <= 1.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Ihsan Sencan in WordPress Plugin Apptha Slider Gallery versions = 1.0...

CVE-2026-18592

CVE-2026-18592 affects osCommerce version 4.14.63493, specifically the function EmailController in app/lib/backend/controllers/EmailController.php of the Email Template Configuration component. The issue arises from manipulating the email_templates_key argument, which leads to a SQL injection vul...

CVE-2026-18592 osCommerce Email Template Configuration EmailController.php EmailController sql injection

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

CVE-2026-16572

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes...

CVE-2026-16532

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-12965

The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database...

WordPress Membership by Supsystic plugin <= 1.4.7 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Erik David Martin in WordPress Plugin Membership by Supsystic versions = 1.4.7...

WordPress product-catalog-8 plugin <= 1.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Lenon Leite in WordPress Plugin Product Catalog 8 versions = 1.2.0...

WordPress WP Google Review Slider plugin <= 6.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Princy Edward in WordPress Plugin WP Google Review Slider versions = 6.1...

WordPress BBS e-Franchise plugin < 1.1.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Lenon Leite in WordPress Plugin BBS e-Franchise versions 1.1.4...

WordPress mwp-viral-signup plugin <= 2.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by TAD Group in WordPress Plugin Wow Viral Signups versions = 2.1...

WordPress PICA Photo Gallery plugin <= 1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ihsan Sencan in WordPress Plugin PICA Photo Gallery versions = 1.0...

CVE-2026-16539 SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks...

CVE-2026-16539 SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks...

EUVD-2026-52182

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks...

CVE-2026-16572 LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes...

CVE-2026-16572 LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes...