449 matches found
CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
CVE-2026-13425
The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-14785
CVE-2026-14785 affects the WordPress plugin Web Directory Free (all versions up to and including 1.7.13). The root cause is insufficient escaping of the user-supplied parameter in the SQL query, and lack of proper query preparation, enabling a generic SQL injection via the levels parameter. This ...
CVE-2026-12741 WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection
The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'formdatas' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-59549
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-59533
Unauthenticated SQL Injection in Relevanssi Light = 1.2.2 versions...
CVE-2026-65876
CVE-2026-65876 affects the Joomla extension from joomshaper.com, specifically the SP Page Builder pre-6.7.1. The vulnerability arises from improper validation of catid parameters in the loadMoreArticles endpoint, yielding an unauthenticated SQL injection. The CVSS 4.0 vector indicates network acc...
PT-2026-64933
Unauthenticated SQL Injection in GamiPress = 7.9.7 versions...
PT-2026-64938
Unauthenticated SQL Injection in AWP Classifieds = 4.4.7 versions...
CVE-2026-61948
Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...
CVE-2026-59526 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...
CVE-2026-9713
CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...
CVE-2026-64828 Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field
Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute ...
EUVD-2016-10909
Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the logi...
EUVD-2026-46417
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...
📄 WordPress Easy Form Builder 3.8.14 Unauthenticated Blind SQL Injection
WordPress Easy Form Builder plugin version 3.8.14 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrate...
CVE-2026-12724 Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user,...
EUVD-2026-45879
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL...
CVE-2026-9586
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...