CVE-2026-89285

Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-89234

WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter

The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-89232

RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-89213

Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-89195

Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-88930

Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-81420

Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62117

WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability

Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62031

WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-45440

WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability

Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42722

WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability

Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42717

WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability

Administrator SQL Injection in Leyka <= 3.32.3 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42712

WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-105889

WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-103695

Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-73663

FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, corrupting the database and modifying FreePBX administrator accounts to obtain unauthorized remote access. This issue is fixed in versions 16.0.11 and 17.0.4.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Freepbx Sangoma

Products

Missedcall Freepbx

CVE-2026-104753

Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-87781

LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96327

WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-95599

WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—