CVE-2026-73183

Maps Marker Pro (WordPress plugin) versions ≤ 4.32 contain an unauthenticated SQL injection vulnerability, allowing remote attackers with no credentials to read sensitive data and potentially affect availability. CVSS 3.1 scores it 9.3 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). Patchstack ha...

EUVD-2026-62376

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-66668

CVE-2026-66668 is a Subscriber SQL Injection vulnerability in the Community by PeepSo WordPress plugin, affecting versions ≤ 9.0.5.2 . The vulnerability was discovered by Yukusawa18 and reported via Patchstack. The CVSS 3.1 base score is 8.5 (HIGH) , with a network attack vector, low complexity, ...

CVE-2026-66668 WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

EUVD-2026-62372

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

CVE-2026-32552

A SQL Injection vulnerability exists in the YITH WooCommerce Membership Premium WordPress plugin, affecting versions 2.33.0 and earlier . The flaw is in the Subscriber functionality and was discovered by dutafi . The CVSS 3.1 score is 8.5 (HIGH) , with a network attack vector, low complexity, and...

CVE-2026-32552 WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin WordPress Persistent Login versions = 3.1.0...

BIT-POSTGRESQL-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

BIT-POSTGRESQL-2026-14673 PostgreSQL amcheck does not clear untrusted search path

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...

WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...

WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability

SQL Injection vulnerability discovered by johska in WordPress Plugin Maps Marker Pro versions = 4.32...

CVE-2026-16950

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-12983

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

EUVD-2026-62273

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-16950

The Product Shortlist WordPress plugin (≤1.0.4) exposes an unauthenticated SQL injection flaw in the get_shortlisted_products function. A parameter is passed unsanitised into a SQL query, enabling remote attackers to extract database contents. CVSS 3.1 scores this HIGH (8.6, AV:N/AC:L/PR:N/UI:N)....

CVE-2026-16950 Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-12983 Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

CVE-2026-12983

The Dinatur WordPress plugin (≤1.18) has an unauthenticated SQL injection via unsanitized column-name input in a SQL query, enabling data exfiltration (CVSS 8.6 HIGH). The same handler also truncates database tables without authorization, allowing any visitor to wipe plugin data. No patch version...

CVE-2026-12983 Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...