70 matches found
CVE-2026-17509
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...
CVE-2026-17509 WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...
CVE-2026-17509 WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...
EUVD-2026-72698
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...
CVE-2026-17509
CVE-2026-17509 is a time-based SQL Injection in the WPML Multilingual CMS WordPress plugin, affecting all versions up to and including 4.9.5 . The root cause is insufficient escaping on the elementIds parameter combined with lack of proper SQL query preparation. A compound authorization bypass —w...
WordPress WPML Multilingual CMS plugin <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection vulnerability
Incorrect Authorization to Authenticated Subscriber+ SQL Injection vulnerability discovered by h0xilo in WordPress Plugin Multilingual CMS versions = 4.9.5...
CVE-2026-17509: Improper Neutralization of Special Elements used in an SQL Command
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...
PT-2026-87028
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...
WordPress WPML Multilingual CMS plugin <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter vulnerability
Authenticated Translator+ SQL Injection via 'sorting' Parameter vulnerability discovered by momopon1415 in WordPress Plugin Multilingual CMS versions = 4.9.5...
CVE-2026-12248 WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter
The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...
CVE-2026-12248
The CVE-2026-12248 entry concerns the WPML Multilingual CMS WordPress plugin. Affected software: WPML (SitePress Multilingual CMS) for WordPress, up to version 4.9.5. Vulnerability class: SQL Injection via the sorting parameter, caused by insufficient escaping of user-supplied input and lack of s...
PT-2026-72887
Name of the Vulnerable Software and Affected Versions WPML Multilingual CMS versions prior to 4.9.6 Description Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow authenticated attackers with translator-level access or higher to perform SQL Injection...
CVE-2026-12248: Improper Neutralization of Special Elements used in an SQL Command
The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...
EUVD-2022-41521
Malicious code in bioql PyPI...
EUVD-2022-47993
Malicious code in bioql PyPI...
EUVD-2022-41045
Malicious code in bioql PyPI...
EUVD-2022-47992
Malicious code in bioql PyPI...
WordPress WPML Multilingual CMS Plugin < 4.6.13 RCE Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpml:wpml"; if description...
CVE-2020-10568
The sitepress-multilingual-cms WPML plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings...