CVE-2026-66594

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

CVE-2026-66583

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

CVE-2025-15688

Unauthenticated SQL Injection in Capella = 2.5.5 versions...

CVE-2026-74013

Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...

CVE-2026-74013 WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability

Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...

EUVD-2026-63315

Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...

CVE-2026-73998

The WordPress WP w3all phpBB plugin (≤ 3.0.5) has a SQL injection vulnerability exploitable by authenticated subscribers with network access; no patch version or in-the-wild exploitation details are provided in the documents.

CVE-2026-73998 WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability

Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...

EUVD-2026-63313

Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...

CVE-2026-73993

The WordPress FundEngine plugin (versions

CVE-2026-73993 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

EUVD-2026-63312

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

EUVD-2026-63309

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

CVE-2026-68566

The WordPress BookingPress Appointment Booking Pro plugin (versions ≤ 6.0.2) contains an unauthenticated SQL injection vulnerability exploitable over the network with no credentials required, scoring 9.3 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). High confidentiality impact is possi...

CVE-2026-68566 WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

EUVD-2026-63306

Unauthenticated SQL Injection in Locatoraid Store Locator = 3.9.72 versions...

CVE-2026-66680

Unauthenticated SQL Injection in Locatoraid Store Locator = 3.9.72 versions...

CVE-2026-66680 WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability

Unauthenticated SQL Injection in Locatoraid Store Locator = 3.9.72 versions...

CVE-2026-66649 WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in Directory Pro = 2.5.8 versions...

CVE-2026-66672 WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...