239239 matches found
EUVD-2026-59904
The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-15351
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-59906
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-15351 WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-9767 The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter
The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-9767
The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-15351
CVE-2026-15351 affects the WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors WordPress plugin. The vulnerability is a generic SQL Injection via the status parameter in all versions up to and including 2.7.0, caused by insufficient escaping of the user-supplied value a...
CVE-2026-9767
CVE-2026-9767 affects The School Management – Education & Learning ERP plugin for WordPress up to version 5.4. The vulnerability is a generic SQL Injection via the parameter order[0][dir] in multiple AJAX handlers (e.g., wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetc...
CVE-2026-17582 Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)
The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...
CVE-2026-17582 Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)
The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...
CVE-2026-17582
Vulnerability details (CVE-2026-17582): The Slider Hero plugin for WordPress is affected up to version 9.1.7 by a second‑order SQL Injection in the qcld_sliderhero_duplicate() function. While slides are safely stored via prepared placeholders in qchero_save_image, triggering the 'heroduplicatesli...
EUVD-2026-59902
The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...
CVE-2026-17582
The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...
CVE-2026-2283
The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blogid' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
EUVD-2026-59896
The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blogid' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-2283 User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter
The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blogid' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-2283
The CVE concerns the WordPress plugin “User Login History.” Affected: WordPress User Login History plugin (all versions up to and including 2.1.7). Issue: SQL Injection via the blog_id parameter caused by insufficient escaping and inadequate query preparation. Context: Exploitation is limited to ...
CVE-2026-15602
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-15963
The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
CVE-2026-16079
The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...