CVE-2026-73187

The WordPress Sticky Chat Widget plugin (versions ≤ 1.4.2) contains an unauthenticated SQL Injection vulnerability, discovered by Nguyen Ba Khanh of HPT Vietnam Corporation. CVSS 3.1 scores it 9.3 (Critical) for network-exploitable high confidentiality impact. CISA SSVC rates it automatable with ...

CVE-2026-66622 WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

EUVD-2026-60915

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-66622

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-66622

The WordPress Depicter Slider plugin (versions ≤ 4.8.0) has an unauthenticated SQL injection vulnerability exploitable over the network, rated HIGH (CVSS 7.5), allowing database disclosure; no in-the-wild exploitation or patch details are provided in the documents. Patchstack's advisory is linked...

CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

EUVD-2026-60902

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

CVE-2026-32466

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

CVE-2026-32466

The Gravity Forms Bookings premium WordPress plugin (versions ≤ 2.1) contains a SQL injection flaw exploitable by authenticated subscribers. CVSS 8.5 (HIGH) reflects network access with low privileges. Patchstack reports it; no in-the-wild exploitation or patch version details are provided in the...

CVE-2026-75778

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-75846

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

EUVD-2026-60732

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-75778 code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-75778

Task Management System 1.0 has a SQL injection in Operation::select_with_multiple_condition within /index.php of the Login Form; the email argument is unparameterized. CVSS 7.3 (HIGH), exploitable remotely with no auth; proof-of-concept exploit is publicly available. No patch or workaround is doc...

CVE-2026-75846 ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

CVE-2026-75846 ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

EUVD-2026-60610

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

WordPress Slider Hero with Video Background, Animation plugin <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate) vulnerability

Authenticated Administrator+ SQL Injection via 'description' Slide Field Second-Order via Duplicate vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Slider Hero versions = 9.1.7...

WordPress WPML Multilingual CMS plugin <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter vulnerability

Authenticated Translator+ SQL Injection via 'sorting' Parameter vulnerability discovered by momopon1415 in WordPress Plugin Multilingual CMS versions = 4.9.5...