CVE-2026-74011 WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

CVE-2026-74011

A Blind SQL Injection vulnerability exists in the InfiniteWP Client WordPress plugin by revmakx, affecting versions through 1.13.9 . The flaw stems from improper neutralization of special elements in SQL commands, allowing an authenticated attacker (high privileges required) to extract data from ...

WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin InfiniteWP Client versions = 1.13.9...

WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Jawn versions = 1.4.2...

CVE-2026-74018

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

CVE-2026-74019

Unauthenticated Broken Access Control in EPROLO Dropshipping = 2.4.2 versions...

CVE-2026-68564

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

CVE-2026-73992

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

CVE-2026-73402

Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...

CVE-2026-73993

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-68566

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

CVE-2026-66615

Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...

CVE-2026-66647

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

CVE-2026-66672

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66616

Unauthenticated Cross Site Scripting XSS in Form Maker by 10Web = 1.15.46 versions...

CVE-2026-66673

Unauthenticated Cross Site Scripting XSS in Flatastic = 2.0 versions...

CVE-2026-66677

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

CVE-2026-66606

Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...

CVE-2026-66612

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

CVE-2026-66592

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...