CVE-2026-85705

The Location Manager plugin for WordPress (up to and including version 2.3.38) is vulnerable to unauthenticated SQL injection via the latitude and longitude REST API parameters. The root cause is insufficient escaping of user-supplied parameters combined with inadequate preparation of the existin...

EUVD-2026-82763

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2026-85705 Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2026-15275

The WP Multi Store Locator Pro WordPress plugin is vulnerable to unauthenticated SQL injection in all versions up to and including 4.5.1 . The root cause is insufficient escaping and unprepared SQL in the store_locator_search_radius parameter, which sits in a numeric, unquoted context that bypass...

CVE-2026-85652 Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'albumid' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

CVE-2026-85652 Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'albumid' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

EUVD-2026-82761

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15275 WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15275 WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-85652

The Photo Gallery by 10Web WordPress plugin (all versions up to and including 1.8.44 ) is vulnerable to time-based SQL injection via the album_id shortcode attribute. The root cause is insufficient escaping of the user-supplied parameter combined with a lack of prepared statements in the underlyi...

CVE-2026-75961

NEX-Forms (Ultimate Forms Plugin for WordPress) versions up to and including 9.3.0 are vulnerable to SQL Injection via the operator key of the additional_params parameter. The root cause is that the operator allowlist enforced by get_table_records() is not applied when the same tainted array is f...

EUVD-2026-82753

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-75961 NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-75961 NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-18442

WCFM Marketplace – Multivendor Marketplace for WooCommerce (WordPress plugin) is vulnerable to unauthenticated SQL injection via the 'wcfmmp_user_location_lng' and 'wcfmmp_user_location_lat' parameters in all versions up to, and including, 3.8.2 . The root cause is insufficient escaping on user-s...

CVE-2026-17607

WP Inventory Manager plugin for WordPress (versions ≤ 2.5.1) is vulnerable to SQL Injection via the 'where' attribute of the [wpinventory] shortcode. The root cause is in the WPIMItem::get_all() function, where parse_custom_where() performs only html_entity_decode(), semicolon stripping, and fiel...

CVE-2026-18442 WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-82748

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-82749

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2026-18442 WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...