CVE-2026-3396

The CVE-2026-3396 entry concerns WCAPF – WooCommerce Ajax Product Filter plugin, affected up to version 4.2.3. The vulnerability is an unauthenticated time-based SQL Injection via the 'post-author' parameter, caused by insufficient escaping of user input and insufficient use of prepared statement...

CVE-2026-3396 WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection

WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-3396

WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-39707

creationtimestamp| type| source ---|---|--- 2026-04-08 11:01:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy5e4f35z2i...

CVE-2026-4300

creationtimestamp| type| source ---|---|--- 2026-04-08 10:51:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy4s7jhqh23...

CVE-2026-39715

creationtimestamp| type| source ---|---|--- 2026-04-08 10:41:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy4ackqvb2i...

CVE-2026-39706

creationtimestamp| type| source ---|---|--- 2026-04-08 10:32:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy3pojsob2i...

CVE-2026-32530

creationtimestamp| type| source ---|---|--- 2026-04-08 10:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3miy3l5c73m2y...

CVE-2026-39714

creationtimestamp| type| source ---|---|--- 2026-04-08 10:28:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy3ixmyap2g...

CVE-2026-39710

creationtimestamp| type| source ---|---|--- 2026-04-08 10:25:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy3cyjtiy2i...

CVE-2026-39709

creationtimestamp| type| source ---|---|--- 2026-04-08 10:22:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy35mhi732d...

CVE-2026-4303

creationtimestamp| type| source ---|---|--- 2026-04-08 10:19:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy2yq3qax2i 2026-05-08 07:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mld7o72lqg2s...

CVE-2026-39704

creationtimestamp| type| source ---|---|--- 2026-04-08 10:17:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy2uao4eu22...

CVE-2026-4025

creationtimestamp| type| source ---|---|--- 2026-04-08 10:15:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy2q45k6u2z 2026-05-08 09:33:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mldgesvod32s...

CVE-2026-39712

creationtimestamp| type| source ---|---|--- 2026-04-08 10:08:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy2fcnj2y25...

EUVD-2026-20223

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through = 5.5.0...

EUVD-2026-20148

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.This issue affects Post Expirator: from n/a through = 4.9.4...

CVE-2026-4300

Robo Gallery for WordPress is affected up to version 5.1.3 with a Stored XSS in the Loading Label field (rbs_gallery_LoadingWord). The plugin uses a custom |... | marker in fixJsFunction() to embed raw JS within JSON; json_encode() preserves quotes, then fixJsFunction() strips the markers, turnin...

CVE-2026-39575

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through = 5.5.0...

CVE-2026-39482

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.This issue affects Post Expirator: from n/a through = 4.9.4...