CVE-2026-116509 Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-116614

The WPMR Google Feed Manager for WooCommerce plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 2.24.1 . The root cause is insufficient escaping of the 'sourceId' parameter and a lack of sufficient preparation on the existing SQL query. Authenticated attackers...

CVE-2026-76173: Sgestion / EasySoft WhatsApp for Dolibarr: Blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for…

Blind SQL injection vulnerability in the public endpoint public/webhook/receiver.php of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the data.key.remoteJid parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization...

VulnCheck KEV: CVE-2026-2579

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 4.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

CVE-2026-95870 wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter

The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-95870

The wpForo Forum plugin for WordPress (versions

CVE-2026-119155 wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-63215 SuiteCRM: Time-Based Blind SQL Injection via REST API

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 getentrylist method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security...

EUVD-2026-115663

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...

CVE-2026-119163

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfancartid' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and...

CVE-2026-115820

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'columns array keys' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-118698

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress (versions up to and including 5.7.14 ) is vulnerable to a SQL Injection flaw. The root cause is insufficient escaping of the user-supplied pgroup parameter and a lack of proper preparation on the existing SQL ...

CVE-2026-118698 JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-118192 JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'teamid' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-116609: osamaesh WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and…

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsmshowTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

CVE-2019-25778

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

CVE-2024-58393

The i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) is vulnerable to an SQL injection flaw. Unauthenticated attackers can manipulate database queries by sending GET requests to /product-details.php using boolean-based , stacked , or time-based SLEEP payloads in the 'id' paramete...

CVE-2024-58393 i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php

i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...

CVE-2024-58393 i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php

i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...

CVE-2022-51023 PHPOK < 5.4.081 SQL Injection via api.php sort Parameter

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...