CVE-2026-15462: Improper Neutralization of Special Elements used in an SQL Command

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

PT-2026-89748

Name of the Vulnerable Software and Affected Versions Sticky Chat Widget versions prior to 1.4.3 Description Unauthenticated attackers can perform SQL Injection through the scw form fields parameter array keys within the scw save form data AJAX action. The issue occurs because the save form data...

Exploit for CVE-2026-18963

My-Exploits Vulnerability research I have done on four widely...

Exploit for CVE-2026-18963

0day-Exploits Vulnerability research I have done on four wide...

Malicious Package

Overview transform-es2015-sticky-regex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-73187

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-73187 WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-73187

The WordPress Sticky Chat Widget plugin (versions ≤ 1.4.2) contains an unauthenticated SQL Injection vulnerability, discovered by Nguyen Ba Khanh of HPT Vietnam Corporation. CVSS 3.1 scores it 9.3 (Critical) for network-exploitable high confidentiality impact. CISA SSVC rates it automatable with ...

CVE-2026-73187

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

EUVD-2026-60938

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-73187 WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Sticky Chat Widget versions = 1.4.2...

PT-2026-77081

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-73187: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100316)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100316 advisory. In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky NIX SQ manager sticky mode is known t...

CVE-2026-15441 Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter

The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptopscrolloffset' shortcode attribute exposed through the unauthenticated wcptajax AJAX handler. The handler is registered for wpajaxnoprivwcptajax, JSON-decodes...

CVE-2026-15441 Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter

The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptopscrolloffset' shortcode attribute exposed through the unauthenticated wcptajax AJAX handler. The handler is registered for wpajaxnoprivwcptajax, JSON-decodes...

EUVD-2026-59861

The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptopscrolloffset' shortcode attribute exposed through the unauthenticated wcptajax AJAX handler. The handler is registered for wpajaxnoprivwcptajax, JSON-decodes...

CVE-2026-15441

The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptopscrolloffset' shortcode attribute exposed through the unauthenticated wcptajax AJAX handler. The handler is registered for wpajaxnoprivwcptajax, JSON-decodes...

PT-2026-73090

Name of the Vulnerable Software and Affected Versions WC Product Table Lite versions prior to 5.6.1 Description An unauthenticated CSS Injection issue exists via the laptop scroll offset shortcode attribute. The wcpt ajax AJAX handler, registered for wp ajax nopriv wcpt ajax, processes...