483512 matches found
CVE-2026-77189 Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...
CVE-2026-77189
The Charitable WordPress plugin (Donation & Fundraising Platform) is vulnerable to SQL Injection via the 'order' attribute of the [charitable_donors] shortcode in all versions up to and including 1.8.12.1 . The root cause is insufficient escaping of the user-supplied parameter combined with a lac...
EUVD-2026-68983
The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...
CVE-2026-76006
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-77823
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-18752
The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...
CVE-2026-17589
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-77823 LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
EUVD-2026-68979
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-77823
The LearnPress WordPress plugin (versions ≤ 4.4.4 ) is vulnerable to SQL injection via the orderby parameter in the export_order_csv AJAX action. The root cause is insufficient escaping: only the literal values date and title are normalized, while any other attacker-controlled string is concatena...
CVE-2026-13203 Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customid' shortcode attribute of the dslcmodulessection and dslcmodulesarea shortcodes in versions up to, and including, 2.1.19. This is due to insufficient input...
CVE-2026-76006 Photo Gallery by Ays <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
EUVD-2026-68974
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-76006
Photo Gallery by Ays (WordPress plugin) versions up to and including 6.8.2 are vulnerable to SQL Injection via the 's' parameter . The root cause is insufficient escaping and lack of query preparation on user-supplied input across two execution paths: $wpdb->get_var() in record_count() and $wp...
EUVD-2026-68971
The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...
CVE-2026-17589
The Shopping Cart & eCommerce Store (WP EasyCart) plugin for WordPress is vulnerable to a second-order SQL injection via the product_order parameter in versions up to 5.9.2 . The payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler with no sanitization on raw $_...
EUVD-2026-68970
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-18752 Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie
The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...
CVE-2026-17589 Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-18752
CVE-2026-18752 affects the Persistent Login plugin for WordPress in all versions up to and including 3.1.0 . The vulnerability is a generic SQL injection via the wppl_device_id cookie, caused by insufficient escaping of the user-supplied parameter and lack of proper query preparation. Authenticat...