108166 matches found
CVE-2026-5651 Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter
The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sqlquery' parameter in multiple AJAX actions askeetexecutesqlquery, askeetexportallresults in all versions up to, and including, 3.0. This is due to the askeetissafequery filter being bypassable using MySQL conditional commen...
CVE-2026-5651
The CVE-2026-5651 entry concerns the WordPress plugin Askeet (versions up to 3.0). Affected component: the plugin’s AJAX actions (askeet_execute_sql_query, askeet_export_all_results) that take the sql_query parameter. Root cause: the askeet_is_safe_query() filter is bypassable via MySQL condition...
CVE-2026-7693 Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the file POST parameter on the restoreBackup AJAX handler. The handler applies escattr — an HTML-context sanitizer that does not strip...
EUVD-2026-53181
The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the filterdatacommentcount parameter of the public tableongettabledata AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied...
CVE-2026-15281 User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection
The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...
EUVD-2026-53178
The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...
CVE-2026-17505
The CVE covers TranslatePress
EUVD-2026-53179
The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...
CVE-2026-17505 TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting
The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...
CVE-2026-8790
The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...
CVE-2026-5062
The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...
EUVD-2026-53034
The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...
CVE-2026-5062 PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter
The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...
CVE-2026-5062
The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...
CVE-2026-5062
CVE-2026-5062 affects PrettyLinks (WordPress plugin) versions up to and including 3.6.20. The vulnerability is an SQL injection via the 's' (search) parameter on the Pretty Links listing page, caused by insufficient escaping and lack of proper prepared statements in search_links_table(). It requi...
EUVD-2026-53040
The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...
CVE-2026-8790
The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...
CVE-2026-8790
CVE-2026-8790 affects the Football Pool WordPress plugin up to version 2.13.4. The issue is a Reflected Cross-Site Scripting in the Shoutbox widget, where the raw POST value of the shouttext parameter is echoed into a textarea via printf('%s', ...) without HTML escaping when a nonce check fails, ...
CVE-2026-15918 VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection
VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...
CVE-2026-18898
A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. This affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to...