CVE-2026-88930

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89213

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-89214

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-81420

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-108541

A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclos...

CVE-2026-103695

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-96797

A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclos...

CVE-2026-108541

A SQL injection vulnerability exists in the highwarden Super Store Finder software up to version 3.8 . The flaw resides in an unknown function within the /products/superstorefinder/index.php file, where the manipulation of the lat/lng arguments allows for remote exploitation. To remediate this is...

CVE-2026-108541 highwarden Super Store Finder index.php sql injection

A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclos...

Astra

Astra Las pruebas de penetración de API REST son complejas debido a los cambios continuos en las API existentes y las API recién agregadas. Astra puede ser utilizado por ingenieros de seguridad o desarrolladores como parte integral de su proceso, permitiéndoles detectar y corregir vulnerabilidade...

CVE-2026-89305 Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

EUVD-2026-96787

The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

EUVD-2026-96790

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89287 ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter

The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

EUVD-2026-96791

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks...

CVE-2026-89297 Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter

The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-96792

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

EUVD-2026-96789

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89305

The paymendo Bank Transfer WordPress plugin (versions through 1.1 ) is vulnerable to SQL injection due to improper sanitization and escaping of the 'orderBy' parameter before it is used in a SQL query. This flaw allows any authenticated user to perform SQL injection attacks. Specific details rega...

CVE-2026-89287

The ASPL Product Quotation WordPress plugin, in versions up to and including 1.1.0 , is vulnerable to SQL injection . The root cause is the failure to sanitize and escape the 'quote_id' parameter before including it in SQL statements. This flaw allows unauthenticated attackers to perform SQL inje...