CVE-2026-96826

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

CVE-2026-96826 WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

CVE-2026-96826 WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

CVE-2026-96826

The W4 Post List WordPress plugin, developed by Shazzad Hossain Khan, is vulnerable to Blind SQL Injection in versions up to and including 3.0.6 . The root cause is the improper neutralization of special elements used in an SQL command. This vulnerability allows an attacker to executeblind SQL qu...

EUVD-2026-85649

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin W4 Post List versions = 3.0.6...

CVE-2026-96826: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

PT-2026-97554

Name of the Vulnerable Software and Affected Versions W4 Post List versions prior to 3.0.6 Description An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questio...

EUVD-2023-31189

Malicious code in bioql PyPI...

CVE-2023-1373

The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...

CVE-2023-27413

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Shazzad Hossain Khan W4 Post List plugin = 2.4.4 versions...

CVE-2023-27413

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Shazzad Hossain Khan W4 Post List plugin = 2.4.4 versions...

CVE-2023-27413

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Shazzad Hossain Khan W4 Post List plugin = 2.4.4 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Shazzad Hossain Khan W4 Post List plugin = 2.4.4 versions...

CVE-2023-27413 WordPress W4 Post List Plugin <= 2.4.4 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Shazzad Hossain Khan W4 Post List plugin = 2.4.4 versions...

CVE-2023-27413

CVE-2023-27413 affects WordPress W4 Post List plugin versions

CVE-2023-27413 WordPress W4 Post List Plugin <= 2.4.4 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Shazzad Hossain Khan W4 Post List plugin = 2.4.4 versions...

CVE-2023-27413: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Shazzad Hossain Khan W4 Post List plugin = 2.4.4 versions...

CVE-2023-1373

The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...

CVE-2023-1371

The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them...