Total
20690 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-76602 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors. | |||||
| CVE-2026-71571 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL. | |||||
| CVE-2026-76613 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries. | |||||
| CVE-2026-74804 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping. | |||||
| CVE-2026-14920 | 2026-08-26 | N/A | 8.2 HIGH | ||
| ## Summary | |||||
| CVE-2026-12721 | 2026-08-26 | N/A | 8.6 HIGH | ||
| The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. | |||||
| CVE-2026-14554 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks. | |||||
| CVE-2026-15258 | 2026-08-26 | N/A | 8.1 HIGH | ||
| The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks. | |||||
| CVE-2026-13596 | 2026-08-26 | N/A | 9.1 CRITICAL | ||
| The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. | |||||
| CVE-2026-15381 | 2026-08-26 | N/A | 3.7 LOW | ||
| The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. | |||||
| CVE-2026-16949 | 2026-08-26 | N/A | 5.8 MEDIUM | ||
| The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. | |||||
| CVE-2026-16589 | 2026-08-26 | N/A | 7.7 HIGH | ||
| The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks. | |||||
| CVE-2026-16532 | 2026-08-26 | N/A | 9.1 CRITICAL | ||
| The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. | |||||
| CVE-2026-15360 | 2026-08-26 | N/A | 9.1 CRITICAL | ||
| The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database. | |||||
| CVE-2026-16572 | 2026-08-26 | N/A | 8.6 HIGH | ||
| The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes. | |||||
| CVE-2026-15361 | 2026-08-26 | N/A | 8.1 HIGH | ||
| The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks. | |||||
| CVE-2026-14238 | 2026-08-26 | N/A | 4.1 MEDIUM | ||
| The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection. | |||||
| CVE-2026-16065 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks. | |||||
| CVE-2026-14872 | 2026-08-26 | N/A | 6.8 MEDIUM | ||
| The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles. | |||||
| CVE-2026-17044 | 2026-08-26 | N/A | 8.6 HIGH | ||
| The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users. | |||||