EUVD-2026-76786

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-10096 Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter

The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'pageid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, t...

SQL Injection

terminal42/contao-tablelookupwizard is vulnerable to SQL Injection. The vulnerability is caused by insufficient sanitization of widget values before they are passed to the database, which allows an attacker to execute arbitrary SQL commands...

PT-2024-40160 · Unknown · Tablelookupwizard

Name of the Vulnerable Software and Affected Versions: tablelookupwizard versions prior to 3.3.5 tablelookupwizard versions prior to 4.0.0 Description: The issue is related to the sanitization of widget values before they are passed to the database, which could lead to an SQL injection possibilit...

GHSA-V3MR-GP7J-PW5W Possible SQL injection in tablelookupwizard Contao Extension

Impact The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility. Patches The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0. For more information If you have any questions or comments...