CVE-2023-30495

WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Ultimate Addons For Contact Form 7

CVE-2023-29432

WordPress Houzez Theme < 2.8.3 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Favethemes

Products

Houzez

CVE-2023-29096

WordPress Contact Form to DB by BestWebSoft Plugin <= 1.7.0 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Bestwebsoft

Products

Contact Form To Db

CVE-2023-28788

WordPress Advanced Page Visit Counter Plugin <= 6.4.2 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: from n/a through 6.4.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Pagevisitcounter

Products

Advanced Page Visit Counter

CVE-2023-28787

WordPress Quiz And Survey Master plugin <= 8.1.4 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.

CVSS 3.1 · 9.3 Critical EPSS 2.0% KEV · Not listed

Vendors

Expresstech Wordpress

Products

Quiz And Survey Master Wordpress

CVE-2023-28491

WordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Tribulant

Products

Slideshow Gallery

CVE-2023-26525

WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.12.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Dokan

Products

Dokan

CVE-2023-25960

WordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zendrop Zendrop – Global Dropshipping zendrop-dropshipping-and-fulfillment allows SQL Injection.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Zendrop

Products

Zendrop

CVE-2023-25045

WordPress RSVPMarker Plugin <= 9.9.3 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Carrcommunications

Products

Rsvpmaker

CVE-2023-23991

WordPress Booking Calendar plugin <= 9.4.3 - SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdevelop / Oplugins Booking Calendar allows SQL Injection.This issue affects Booking Calendar: from n/a through 9.4.3.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2022-47605

WordPress Custom 404 Pro Plugin <= 3.7.0 is vulnerable to SQL Injection (SQLi)

Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.7.0 versions.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Kunalnagar

Products

Custom 404 Pro

CVE-2022-47593

WordPress RapidLoad Power-Up for Autoptimize Plugin <= 1.6.35 is vulnerable to SQL Injection

Auth. (subscriber+) SQL Injection (SQLi) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize plugin <= 1.6.35 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rapidload

Products

Rapidload Power-up For Autoptimize

CVE-2022-47151

WordPress JS Help Desk plugin <= 2.7.1 - Unauth. SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Joomsky Wordpress

Products

Js Help Desk Wordpress

CVE-2022-38074

WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection

SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Veronalabs

Products

Wp Statistics

CVE-2021-36898

WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. SQL Injection (SQLi) vulnerability

Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Expresstech

Products

Quiz And Survey Master

CVE-2026-7282

SourceCodester Pharmacy Sales and Inventory System ajax.php delete_expired sql injection

A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function delete_expired of the file /ajax.php?action=delete_expired. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Pharmacy Sales And Inventory System

CVE-2026-24572

WordPress Nelio Content plugin <= 4.2.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio Content nelio-content allows Blind SQL Injection.This issue affects Nelio Content: from n/a through <= 4.2.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2026-40529

SQL Injection in CMS ALAYA Enabling Data Alteration

CMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability. Information stored in the database may be obtained or altered by an attacker with access to the administrative interface.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Kanata

Products

Cms Alaya

CVE-2026-41478

Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also enable database modification or destruction depending on the backend. This vulnerability is fixed in 1.4.6, 1.5.6, and 1.6.0-beta.5.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Saltcorn

Products

Saltcorn

CVE-2026-7199

SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_product. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Pharmacy Sales And Inventory System