EUVD-2026-96792

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

CVE-2026-89305

The paymendo Bank Transfer WordPress plugin (versions through 1.1 ) is vulnerable to SQL injection due to improper sanitization and escaping of the 'orderBy' parameter before it is used in a SQL query. This flaw allows any authenticated user to perform SQL injection attacks. Specific details rega...

CVE-2026-89304

The paymendo Bank Transfer WordPress plugin version 1.1 and below is vulnerable to unauthenticated blind SQL injection . The root cause is the failure to properly sanitize and escape the 'paymendo_bank_transfer_completed_payment' parameter before incorporating it into a SQL query. This flaw allow...

CVE-2026-89297

The Loja Automática WordPress plugin (versions through 1.0.0 ) is vulnerable to SQL injection due to improper sanitization and escaping of a parameter before its use in a SQL query. This flaw allows unauthenticated users to perform SQL injection attacks, specifically via the 'id' parameter . The ...

CVE-2026-89287

The ASPL Product Quotation WordPress plugin, in versions up to and including 1.1.0 , is vulnerable to SQL injection . The root cause is the failure to sanitize and escape the 'quote_id' parameter before including it in SQL statements. This flaw allows unauthenticated attackers to perform SQL inje...

CVE-2026-89299

The WP Verify API WordPress plugin, versions through 1.0.0 , contains a vulnerability where a parameter is not properly sanitized or escaped before being used in a SQL query . This flaw allows unauthenticated users to perform SQL injection attacks. Specifically, the 'verify' parameter is identifi...

CVE-2026-89299 WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89287 ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter

The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-89305 Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

CVE-2026-89302

The Post Voting System WordPress plugin (versions up to and including 1.0 ) is vulnerable to SQL injection because it fails to properly sanitize and escape a parameter before including it in a SQL query. This flaw allows unauthenticated users to perform SQL injection attacks, specifically via the...

EUVD-2026-96789

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89302 Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89297 Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter

The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-96784

The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

EUVD-2026-96786

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

EUVD-2026-96782

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

EUVD-2026-96781

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

EUVD-2026-96783

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-89214

The WpCues Basic Quiz WordPress plugin, in versions up to and including 1.6.5 , contains a vulnerability where it fails to properly sanitize and escape values before incorporating them into a SQL statement . This flaw allows unauthenticated attackers to perform SQL injection attacks, potentially ...

CVE-2026-89285

The Datalist it WordPress plugin, in versions up to and including 0.0.3 , is vulnerable to SQL injection due to a failure to sanitize and escape several request parameters before building a SQL query. This flaw allows unauthenticated attackers to perform SQL injection and read arbitrary data from...