CVE-2026-44472

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

CVE-2026-28567

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28567

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

EUVD-2026-60892

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28567

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28567 WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

WordPress Slider Hero with Video Background, Animation plugin <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate) vulnerability

Authenticated Administrator+ SQL Injection via 'description' Slide Field Second-Order via Duplicate vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Slider Hero versions = 9.1.7...

WordPress Contest Gallery plugin <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' vulnerability

Authenticated Author+ Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Contest Gallery versions = 30.0.7...

XWiki Platform - SQL Injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

CVE-2026-9767

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-17582

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

CVE-2026-17582

Vulnerability details (CVE-2026-17582): The Slider Hero plugin for WordPress is affected up to version 9.1.7 by a second‑order SQL Injection in the qcld_sliderhero_duplicate() function. While slides are safely stored via prepared placeholders in qchero_save_image, triggering the 'heroduplicatesli...

CVE-2026-17582 Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

EUVD-2026-59902

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

CVE-2026-17582 Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

CVE-2026-17582

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

CVE-2026-15602

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-15602 NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-15602

CVE-2026-15602 affects the NEX-Forms – Ultimate Forms Plugin for WordPress up to version 9.2.4. The vulnerability is a generic SQL Injection via the additional_params parameter, due to insufficient escaping and poor query preparation. It is a second‑order issue: a payload is stored via the submis...

EUVD-2026-59851

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...