cve-2026-3180

CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - Inyección SQL ciega no autenticada Descripción Se descubrió una vulnerabilidad de Inyección SQL ciega Blind SQL Injection en el plugin WordPress Contest Gallery versiones 28.1.4 y anteriores. El problema ocurre debido al uso inseguro del parámetr...

CVE-2026-19800 Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-19800 Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-17582

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

PT-2026-73112

Name of the Vulnerable Software and Affected Versions Slider Hero versions prior to 9.1.8 Description An issue exists where authenticated attackers with administrator-level access can perform a second-order SQL Injection. While slide data such as description, title, btn, btn2, image link, and...

CVE-2026-15162

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162 Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162 Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

EUVD-2022-24869

Malicious code in bioql PyPI...

EUVD-2025-3407

Malicious code in bioql PyPI...

CVE-2022-1578

The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack...

CVE-2025-23774

Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affects WPDB to Sql: from n/a through = 1.2...

CVE-2025-23774

Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affects WPDB to Sql: from n/a through = 1.2...

CVE-2025-23774 WordPress WPDB to Sql plugin <= 1.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affects WPDB to Sql: from n/a through = 1.2...

CVE-2025-23774

CVE-2025-23774 is described as an information-exposure flaw in the WordPress plugin WPDB to SQL (NotFound WPDB to Sql). Public text states it affects the plugin version range “from n/a through 1.2” and that the issue is an Insertion of Sensitive Information Into Sent Data vulnerability that allow...

CVE-2025-23774: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affects WPDB to Sql: from n/a through = 1.2...

CVE-2024-12615

The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb-prefix value in several AJAX actions in all versions up to, and including, 1.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2024-12613

The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb-prefix value in several AJAX fuctions in all versions up to, and including, 1.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2024-12615: Improper Neutralization of Special Elements used in an SQL Command

The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb-prefix value in several AJAX actions in all versions up to, and including, 1.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

PT-2025-1912 · WordPress · Passwords Manager

Name of the Vulnerable Software and Affected Versions: Passwords Manager plugin for WordPress versions 1.4.8 and earlier Description: The issue is related to SQL Injection via the $wpdb-prefix value in several AJAX functions due to insufficient escaping on the user supplied parameter and lack of...