CVE Database

CVE-2026-56068 Critical · 9.3 CWE-89 Jun 26, 2026

JetEngine WordPress Plugin Unauthenticated SQL Injection (CVE-2026-56068)

Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.

CVE-2026-56067 Critical · 9.3 CWE-89 Jun 26, 2026

JetSmartFilters WordPress Plugin Unauthenticated SQL Injection (CVE-2026-56067)

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.

CVE-2026-56064 High · 8.5 CWE-89 Jun 26, 2026

WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability

Subscriber SQL Injection in Tourfic <= 2.22.5 versions.

CVE-2026-56062 Critical · 9.3 Public exploit CWE-89 Jun 26, 2026

WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.

CVE-2026-56036 Critical · 9.3 CWE-89 Jun 26, 2026

WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.

CVE-2026-56034 Critical · 9.3 CWE-89 Jun 26, 2026

WordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerability

Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.

CVE-2026-54831 Critical · 9.3 CWE-89 Jun 26, 2026

GeoDirectory WordPress Plugin Unauthenticated SQL Injection

Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.

CVE-2026-54827 Critical · 9.3 CWE-89 Jun 26, 2026

Real Estate 7 Theme - Unauthenticated SQL Injection (CVE-2026-54827)

Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.

CVE-2026-54825 Critical · 9.3 CWE-89 Jun 26, 2026

wpDataTables Unauthenticated SQL Injection

Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.

CVE-2026-54820 Critical · 9.3 CWE-89 Jun 26, 2026

JetBooking: Unauthenticated SQL Injection (CVE-2026-54820)

Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.

CVE-2026-13226 Medium · 6.5 CWE-89 Jun 25, 2026

Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Sales Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler wp_ajax_groundhogg_get_contacts_table has its capability check commented out and performs no nonce verification, meaning any authenticated user regardless of role can reach the vulnerable code path.

CVE-2026-40083 High · 7.2 CWE-89 Jun 25, 2026

Cacti: SQL Injection in managers.php

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selected_items by calling cacti_unserialize(stripslashes(gnrv('selected_graphs_array'))). The cacti_unserialize() function calls unserialize() with allowed_classes set to false, which prevents object injection but still allows arbitrary string arrays to be deserialized. Then, at lines 760 to 766, the deserialized array values are passed directly into db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $selected_items) . ')'), where they are imploded into the SQL statement without any integer validation, resulting in SQL Injection when using SNMP agent management permissions. This issue has been fixed in version 1.2.31.

CVE-2026-37149 High · 7.7 CWE-89 Jun 25, 2026

GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to…

GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

CVE-2026-57588 Low · 3.3 Public exploit CWE-89 Jun 25, 2026

SQL Injection in Nessus via Malicious Scan Result File Import

A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.

CVE-2026-57587 Medium · 5.3 CWE-89 Jun 25, 2026

SQL Injection in Nessus via Reverse DNS Lookup

A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.

CVE-2026-54849 Critical · 9.3 CWE-89 Jun 25, 2026

Premmerce Wishlist for WooCommerce Unauthenticated SQL Injection

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

CVE-2026-54843 Critical · 9.3 CWE-89 Jun 25, 2026

MDTF Plugin Unauthenticated SQL Injection

Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

CVE-2026-54838 High · 8.5 CWE-89 Jun 25, 2026

WordPress WC Vendors Marketplace plugin <= 2.6.8 - SQL Injection vulnerability

Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.

CVE-2026-54836 Critical · 9.3 Public exploit CWE-89 Jun 25, 2026

YMC Filter - SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.

CVE-2026-54829 High · 7.5 CWE-89 Jun 25, 2026

WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.

CVE-2026-54822 High · 8.5 CWE-89 Jun 25, 2026

WordPress SALESmanago & Leadoo plugin <= 3.11.2 - SQL Injection vulnerability

Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.

CVE-2026-12937 High · 7.5 CWE-89 Jun 25, 2026

Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler is registered for unauthenticated users via wp_ajax_nopriv_tf_room_availability, and the required nonce is emitted on the public single-hotel page template, allowing unauthenticated attackers to freely obtain a valid nonce and reach the vulnerable code path.

CVE-2026-2508 Medium · 6.5 CWE-89 Jun 25, 2026

Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'

The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staff_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2026-12079 Medium · 6.5 CWE-89 Jun 25, 2026

Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2026-12077 High · 7.5 CWE-89 Jun 25, 2026

Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.