WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin UpSolution Core versions = 9.3...

CVE-2026-97634

The Event Tickets and Registration plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 5.29.5 . The root cause is insufficient escaping of the user-supplied orderby parameter and a lack of sufficient preparation on the existing SQL query. This allows ...

CVE-2026-97634 Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

EUVD-2026-91256

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-97634 Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-12951

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection in versions up to and including 5.0.18 . The flaw exists in the order_by parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint. The root cause is the direct concatenation of user-supplied input i...

EUVD-2026-91246

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-12951 MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-12951 MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

SQL Injection vulnerability discovered by b1ue0cean in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.20...

CVE-2026-94298

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed b...

CVE-2026-94298 BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed b...

EUVD-2026-91195

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed b...

CVE-2026-94298

The BuildKit WordPress plugin versions prior to 1.0.29 is vulnerable to a Stored SQL Injection flaw. The root cause is the improper sanitization and escaping of data submitted by contributor-level users before it is stored and subsequently used in a SQL query via the list_content parameter. This ...

CVE-2026-104123

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer0/admins/assessments/activities/btnfunctions.php?action=activity. The manipulation of the argument Title results in sql injection...

CVE-2026-104123 SourceCodester Online Reviewer Management System btn_functions.php activity sql injection

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer0/admins/assessments/activities/btnfunctions.php?action=activity. The manipulation of the argument Title results in sql injection...

CVE-2026-104123 SourceCodester Online Reviewer Management System btn_functions.php activity sql injection

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer0/admins/assessments/activities/btnfunctions.php?action=activity. The manipulation of the argument Title results in sql injection...

EUVD-2026-91164

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer0/admins/assessments/activities/btnfunctions.php?action=activity. The manipulation of the argument Title results in sql injection...

CVE-2026-104123

The SourceCodester Online Reviewer Management System 1.0 is vulnerable to SQL injection due to an unknown functionality in the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. By manipulating the Title argument, an attacker can execute arbitrary SQL commands. This...

CVE-2026-104052

A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file adminrejectcompleted.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly...