SQL Injection

Blind SQL injection in the Slider by 10Web WordPress plugin through version 1.2.63 allows an authenticated high-privilege user (CVSS PR:H, typically administrator-level) with network access to the vulnerable request handler to inferentially extract database contents, with confidentiality-only impact per the independent assessment. The input CVSS 3.1 vector describes a network-reachable, low-complexity flaw, but the high-privilege requirement is a critical mitigating factor because anonymous or unprivileged users cannot reach the vulnerable code path. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS data was provided; patch availability is not confirmed from the supplied data.

Blind SQL injection in the Gopiplus 'Post title marquee scroll' WordPress plugin (all versions through 9.9) allows an authenticated user with administrator-level privileges to inject arbitrary SQL into backend database queries and infer data through boolean- or time-based responses. The highest realistic impact is full disclosure of data stored in the WordPress database (CVSS:C:H), with the attacker population sharply constrained by the PR:H prerequisite - anonymous visitors and ordinary subscribers cannot reach the vulnerable functionality. As of analysis there is no CISA KEV listing and no public exploit code identified, and because the injection is blind, successful exploitation requires iterative inference rather than direct retrieval of results; the vendor has not published a fixed version, so the plugin should be removed or disabled until an update appears.

Blind SQL injection in the WordPress/WooCommerce plugin Pix por Piggly (para WooCommerce) through version 2.1.2 allows an authenticated user holding high privileges on the site - such as a WordPress administrator or a WooCommerce shop manager - to inject arbitrary SQL into backend queries and extract database contents through inference-based techniques. The flaw is CWE-89 (improper neutralization of special elements in an SQL command), reported by Patchstack, and carries a disclosed CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N, with the reporter's vector claiming scope change, high confidentiality impact, no integrity impact and low availability impact); our own assessed vector narrows this to S:U/C:H/I:N/A:N, keeping the practical severity essentially the same. The high-privilege prerequisite (PR:H) is the decisive constraint: anonymous visitors and ordinary subscribers cannot reach the vulnerable path, so risk is concentrated in sites where lower-trust staff accounts exist, where shop-manager credentials are shared, or where a privileged account has already been compromised. No public exploit code and no confirmed active exploitation were identified at time of analysis.

Unauthenticated SQL injection in the Site Search function of Movable Type allows a remote attacker to run arbitrary SQL queries against the affected site's database, producing high confidentiality impact with limited integrity and availability impact (CVSS 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Affected deployments are Movable Type and Movable Type Premium (self-hosted) plus the Movable Type Cloud Edition and Premium Cloud Edition services from Six Apart Ltd. This is a genuine high-priority vulnerability: the CVSS vector confirms the attack is network-reachable with no privileges and no user interaction, so any instance exposing the standard public Site Search is in scope, although no public exploit code and no confirmed active exploitation were identified at time of analysis.

Blind SQL injection in the Sarah Giles 'Dynamic User Directory' WordPress plugin, affecting all versions up to and including 2.4, lets an attacker with an existing high-privilege account on the target WordPress site inject arbitrary SQL into a plugin query and exfiltrate database contents by observing boolean or timing differences in responses, since the query results are not returned directly. The flaw is remotely reachable with low attack complexity and no user interaction, but the CVSS:3.1/AV:N/AC:L/PR:H/UI:N vector means it is only exploitable by an authenticated, high-privilege user - a significant limiting factor that narrows the realistic attacker set to trusted administrators or attackers who have already compromised a privileged account. Our independent assessment scores the issue 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N), lower than the 7.6 reported by the finder, because scope is unchanged and integrity and availability impact are limited; there is no CISA KEV listing and no public exploit identified at time of analysis, although a Patchstack advisory documents the issue.

Blind SQL injection in the WordPress plugin affiliate-toolkit (a.k.a. affiliate-toolkit-starter) through version 3.9.1 lets an attacker with an authenticated, high-privilege (administrator-level) account inject arbitrary SQL into plugin queries and exfiltrate database contents through inference-based techniques. The attack is remote, low complexity, and requires no victim interaction once that privileged session exists, but the administrator-level prerequisite (PR:H) sharply limits the realistic attacker pool, and because the injection is blind, exploitation is slower and noisier than a direct-output SQLi. Per our independent assessment this is a moderate-priority issue rather than an emergency; no public exploit identified at time of analysis, and no CISA KEV listing applies.

Unauthenticated SQL injection in the Manacle Multi-Tenant ERP System's API endpoint allows remote attackers to inject arbitrary SQL through crafted input, giving high impact to both data confidentiality and integrity (CVSS 4.0 score 9.3; assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N). The affected CPE (cpe:2.3:a:manacle_technologies:multi-tenant_erp_system:*) carries no version constraint, indicating the flaw is described against the product as a whole rather than a bounded release range, and no fixed version is named in the advisory. There is no public exploit identified at time of analysis and no CISA KEV listing; no EPSS score was supplied in the source data, so likelihood of exploitation should be judged from exposure alone.

Unauthenticated SQL injection in the OrdaSoft Simple Membership extension for Joomla (versions before 7.4.0) allows any remote attacker to read and manipulate the site's backend database through crafted input to the checkLoginPass task. The site/simplemembership.php endpoint dispatches task=checkLoginPass with no authentication or access-control check and concatenates the login request parameter straight into a SQL query with no escaping or parameterization, which scores 9.3 under CVSS 4.0 with PR:N and no user interaction required. Exploitation needs only that the component be installed and enabled on a publicly reachable Joomla site - no credentials, user interaction, or non-default setting - and no public exploit identified at time of analysis.

SQL injection in the ClearPass Policy Manager API lets a remote attacker who already holds administrative privileges execute arbitrary database commands against the appliance, putting the confidentiality, integrity, and availability of its configuration and policy data at high risk (CVSS 7.2). The privilege requirement is the decisive constraint: exploitation requires network reachability to the management/API interface plus valid admin-level credentials (PR:H, AV:N, AC:L, UI:N), so realistic exposure is limited to privileged insiders or attackers who have first compromised an administrator account. No public exploit code and no confirmed active exploitation were identified at time of analysis, which keeps this a high-but-not-critical issue whose severity in practice tracks how well admin access and management-plane reachability are controlled.

SQL injection in the web-based management interface of ClearPass Policy Manager lets a low-privileged authenticated remote attacker inject arbitrary SQL and run database commands against the underlying ClearPass instance, yielding high confidentiality, integrity and availability impact with a scope change (CVSS 3.1 base 9.9). The flaw is not pre-authentication: the attacker must already hold a valid low-privilege operator account or session on the management UI (PR:L), and no non-default feature or special configuration is needed beyond that (AC:L, UI:N). There is no public exploit identified at time of analysis and no known active exploitation, but the severity plus the sensitivity of the data held by a network access control policy store make this a genuine high-priority remediation item rather than a high-CVSS outlier.

SQL injection in the web-based management interface of HPE Aruba ClearPass Policy Manager allows an authenticated attacker with high-privilege (PR:H) management-interface access to inject SQL into backend queries and run arbitrary database commands, with a vendor-assigned CVSS of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The impact is severe - confidentiality, integrity and availability of the appliance database are all rated high, and the scope change (S:C) indicates the compromise can escape the vulnerable component - but the precondition of valid administrative credentials plus network reachability to the management UI substantially narrows the practical attack surface, and no public exploit code has been identified at time of analysis. No evidence of active exploitation (CISA KEV) is present in the provided intelligence; this is a genuinely high-severity issue that warrants prompt patching but is not an untriaged emergency.

Unauthenticated SQL injection in HPE Aruba Networking ClearPass Policy Manager allows a remote attacker who can reach the affected interface to inject arbitrary SQL into the application's database layer, with successful exploitation enabling execution of arbitrary database commands. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are required and the confidentiality, integrity, and availability impact is total; any ClearPass instance whose management/web service is reachable from an untrusted network is directly at risk. No public exploit code has been identified at time of analysis and the flaw is not in CISA's KEV catalog, but the pre-authentication, network-reachable profile and the database-command execution outcome make this a high-priority item for exposure reduction and patching per the HPE advisory.

Authenticated SQL injection in the Arista CloudVision CUE API allows a network user with valid credentials to degrade backend availability by supplying malicious values in specific request parameters that lack proper validation. The CVSS 4.0 score is 7.1 (High), driven entirely by high availability impact (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N), which is atypical for SQL injection. No public exploit code has been identified at time of analysis, and exploitation requires prior authentication (PR:L).

Authenticated SQL injection in Payload CMS allows a user holding read plus create or update permission on a collection that contains a json field - or a blocks field with blocksAsJSON enabled - to inject arbitrary SQL through crafted field paths and query operators when the site runs on the Postgres or SQLite database adapters. Only collections carrying those specific field types are reachable; collections built purely from text and richText fields are explicitly not affected, and richText fields themselves are not exploitable. The flaw requires an authenticated principal (CVSS PR:L) with write access, which materially narrows the attack surface, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; Payload has shipped fixes in 3.90.0 (SQLite adapters), 3.73.0 (Postgres adapters) and 4.0.0-canary.34.

SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote attackers to inject arbitrary SQL when the instance runs the SQLite (@payloadcms/db-sqlite) or Postgres (@payloadcms/db-postgres) adapter and untrusted users can query readable collections while supplying dynamic filters or join parameters. MongoDB-backed deployments are explicitly not affected, and the practical blast radius is bounded by which collections are readable to the attacker - if access control blocks those queries or dynamic filter/join input is not accepted, exploitation is blocked (the vendor-documented workaround). Vendor patches ship in 3.88.0 and 4.0.0-canary.27; no public exploit code was identified at time of analysis, and our independent assessment rates this a genuine high-priority issue with read-confidentiality impact dominating (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) rather than the vendor-published 9.8.

Ciphertext tampering in the Cloak Elixir encryption library (danielberkompas/cloak, all versions from 0.1.0-pre onward) lets anyone with write access to the encrypted store silently flip bits in stored ciphertext so that decryption returns an attacker-chosen plaintext of the same length. The affected code paths, Cloak.Ciphers.AES.CTR and Cloak.Ciphers.Deprecated.AES.CTR, encrypt with AES-256 in CTR mode and store the key tag, IV, and ciphertext with no MAC, and decrypt/2 validates only the key tag and a minimum length - so tampered data is returned as valid with no error. Exploitation requires write access to the ciphertext (the description cites SQL injection into the Ecto-backed database or a compromised replica) plus knowledge or a correct guess of the existing plaintext at the tampered offset, and the replacement value must be exactly the same length as the original; impact is integrity-only (VC:N/VA:N), with no public exploit identified at time of analysis. Note the vendor CVSS 4.0 score of 8.2 is driven entirely by VI:H, while an independent assessment applying CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) rates the realistic risk considerably lower because an attacker must already control writes to the encrypted store and have plaintext knowledge.

SQL injection in the Paid Member Subscriptions WordPress plugin through version 3.1.1 allows authenticated subscriber-level users to execute crafted SQL queries and read sensitive data from the site's database. The independent assessment gives a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L (reported base 8.5), meaning confidentiality is high while integrity and availability impact are low and scope is unchanged. Exploitation requires only any valid subscriber account, which is typically easy to obtain on sites using this plugin for open self-service registration; no public exploit identified at time of analysis.

Unauthenticated SQL injection in ARMember Premium versions 7.8 and earlier allows remote attackers to execute arbitrary SQL queries against the underlying WordPress database, potentially exposing sensitive information. The flaw requires no authentication (PR:N) or user interaction (UI:N), and its scope change (S:C) indicates the database is a security authority distinct from the web application. No public exploit identified at time of analysis, but the CVSS score of 9.3 reflects the high confidentiality impact.

SQL injection in UDesign Core WordPress plugin versions 4.15.0 and earlier allows an authenticated attacker with Subscriber-level access or higher to read sensitive data from the underlying database. Our independent assessment rates this as high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) and unchanged scope, differing from the provider CVSS vector which claims scope change and low availability impact. Exploitation requires an account on the target site; many WordPress sites enable open registration, lowering the barrier, but no public exploit identified at time of analysis.

Unauthenticated SQL injection in the Porto Theme Functionality WordPress plugin affects versions up to and including 3.9.3, allowing remote attackers to inject arbitrary SQL into the plugin's database queries without any prior authentication (CVSS vector PR:N, no user interaction). Successful exploitation can expose sensitive data stored in the site's WordPress database - the independent assessment rates confidentiality impact as High and integrity impact as Low, while the vendor/feed score of 9.3 assumes scope change and a different impact mix; both agree the issue is trivially network-reachable. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a high-severity, easily reachable flaw rather than a confirmed actively exploited campaign, and no fixed plugin version is specified in the supplied advisory data.

SQL injection in the ListingPro WordPress plugin through version 2.9.12 allows an authenticated Subscriber-level attacker to inject arbitrary SQL through a plugin code path, exposing database contents such as user credentials hashes, listing records, and site configuration. Exploitation requires a valid Subscriber account, which is easy to obtain on sites with self-registration enabled, and only WordPress installations where the plugin is installed and activated are exposed; sites upgraded past 2.9.12 are not affected. No public exploit identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV); the issue is genuinely actionable but below top-tier urgency, with the practical risk concentrated on open-registration membership and directory sites.

Unauthenticated SQL injection in the Weblizar WordPress plugin 'Newsletter Subscription Form - User Subscriptions Form, Capture Email' (versions up to and including 1.5.9) lets an attacker who can reach the plugin's public subscription/capture-email form endpoint inject SQL through user-supplied input. Per the CVSS vector (PR:N/UI:N), no authentication or victim interaction is required, so any site running this plugin with a publicly reachable form is exposed; the primary limit on real-world exposure is simply whether this relatively uncommon plugin is installed. The feed score is 9.3, while our independent assessment scores it 8.1 (scope unchanged, confidentiality high, integrity low, availability none) because the demonstrated impact is primarily database read-out rather than full compromise. No public exploit code and no confirmed active exploitation (no CISA KEV entry) were identified at time of analysis, so this is a high-severity but not yet corroborated-as-exploited issue.

Unauthenticated SQL injection in the SendPress Newsletters WordPress plugin (all versions up to and including 1.26.1.20) allows a remote attacker who can reach an affected site to inject arbitrary SQL and read data from the site's database - including WordPress user credential hashes, secret keys and plugin/configuration tables - with no login and no user interaction. Our independent assessment recalibrates the reported CVSS 9.3 (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5): a genuine high-priority issue rather than a CVSS-inflated one, with confidentiality-only impact and unchanged scope. The practical limiting factor is deployment - only sites actively running this plugin at or below the vulnerable version are exposed, and the exact injectable endpoint/parameter is not disclosed - and no public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.

Unauthenticated SQL injection in the WordPress plugin Gmedia Photo Gallery (versions 1.25.1 and earlier) allows remote attackers to inject arbitrary SQL into database queries and read data the application can access, which the assessment rates as high confidentiality impact with no integrity or availability impact. Any WordPress site with the plugin installed and active is potentially exposed because exploitation requires no account, no privileges, and no victim interaction (AV:N/AC:L/PR:N/UI:N); the practical gate is deployment - the site must run an unpatched version and expose the vulnerable endpoint to the network. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the reporter's 9.3 score and the zero-prerequisite vector make it a high-priority item for inventory and patching rather than a CVSS-inflated finding.

SQL injection in the BuddyBoss Platform WordPress plugin (versions 3.1.0 and earlier) lets an authenticated low-privilege user - specifically a subscriber-level account - inject SQL through a plugin input that is not safely parameterized, exposing data stored in the site's database. Because BuddyBoss powers community and social-networking sites that very often leave open user self-registration enabled, the Subscriber role required by the vector (PR:L) is usually trivial to obtain, and no user interaction or non-default configuration is needed beyond a valid account. The vendor CVSS base score is 8.5 (High) with scope change, high confidentiality impact and low availability impact; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.

Unauthenticated SQL injection in the WordPress plugin Radius Booking - Booking Calendar for Appointments & Services through 1.0.19 allows remote attackers to read arbitrary database data through crafted input, with the independent assessment limiting confirmed impact to confidentiality (C:H/I:N/A:N). Affected sites are only those with this specific plugin installed and active at a vulnerable version; no authentication, user interaction, or non-default configuration is required. No public exploit or CISA KEV entry is identified at time of analysis, and deployment scope is the primary limiting factor.

Authenticated SQL injection in the Woffice WordPress theme at versions 5.4.35 and earlier lets any Subscriber-level account supply crafted input through an as-yet-unidentified theme endpoint and read arbitrary data from the site's database, including wp_users credential material and any other records the database account can reach. Exploitation is remote (AV:N) and requires no user interaction (UI:N), but does require a valid low-privilege account (PR:L) - a barrier that is minimal on the intranet, membership and community sites Woffice targets, where open self-registration is common. Patchstack reports an 8.5 score, while our independent assessment rates it 6.5 (scope-unchanged, confidentiality-only, no integrity or availability impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and the exact vulnerable parameter must be confirmed from the Patchstack advisory.

Unauthenticated SQL injection in the Booknetic WordPress plugin (versions 4.8.5 and earlier) lets any remote attacker inject arbitrary SQL into database queries handled by the plugin, yielding direct read access to the underlying WordPress database. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), the injection is reachable before authentication against a default plugin installation, so any internet-reachable WordPress site with Booknetic active and a publicly accessible booking page is a viable target - no account, no user interaction, and no non-default configuration required. The practical ceiling on impact is set by product presence: only sites actually running the affected plugin are exposed, and the value of exploitation scales with how much sensitive data the WordPress database holds; no public exploit code has been identified at time of analysis, and no EPSS score was supplied in the available intelligence, though the reported 9.3 CVSS score and confidentiality-heavy impact justify treating this as a high-priority patch.

SQL injection in the Mooberry Book Manager plugin for WordPress (4.16.2) allows an attacker holding an authenticated Subscriber-level account to inject SQL through plugin input and read data from the underlying WordPress database. Exploitation needs only a low-privilege account and no victim interaction, so sites with open user registration are the most exposed, though the confirmed impact is information disclosure rather than data tampering. No public exploit code has been identified and there is no CISA KEV entry or other indication of active exploitation at the time of analysis, so this is a moderate-priority issue rather than an urgent one.

Unauthenticated SQL injection in WooCommerce Lottery (WPGenie) versions up to and including 2.2.9 lets a remote attacker who can reach the plugin's lottery endpoint inject SQL against the underlying WordPress database, reading arbitrary data from it. No credentials or user interaction are required (PR:N, UI:N), and the vendor-assigned vector notes high confidentiality impact with limited availability effect, though its AC:H rating alongside our assessed AC:L indicates the reliability of the injection depends on conditions at the injection point that the advisory does not fully enumerate. Exploitation is narrow in practice because only WordPress sites running both WooCommerce and this specific niche paid add-on are exposed; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.

Unauthenticated SQL injection in the WooCommerce Appointments WordPress plugin (versions up to and including 5.3.2) lets any remote attacker without credentials or user interaction inject arbitrary SQL through the plugin's request handling, giving high confidentiality impact with limited integrity impact and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N per independent assessment; the CVE record publishes a 9.3 score with a scope-changed vector). Because WooCommerce Appointments is a commercial paid booking add-on that must be licensed and activated on top of WooCommerce, exposure is confined to that subset of WooCommerce stores running a vulnerable version rather than the WordPress install base at large, which is the main factor keeping this a priority fix rather than an emergency. No public exploit identified at time of analysis.

Authenticated SQL injection in WP2LEADS plugin versions 3.5.7 and earlier allows any Subscriber-level user to execute arbitrary SQL queries, resulting in high confidentiality impact and low integrity/availability impact. The vulnerability is network-reachable (AV:N) with low attack complexity (AC:L) and requires only low-privilege authentication (PR:L), making sites with open user registration particularly at risk. No public exploit identified at time of analysis.

Unauthenticated SQL injection in the eLoanApp Platform's AJAX user-verification endpoint allows remote attackers to inject boolean- and time-based payloads into the POST parameter 'logina', enabling database engine discovery and query delays. The affected product is RDL Technologies eLoanApp Platform as represented by CPE cpe:2.3:a:rdl_technologies:eloanapp_platform:*:*:*:*:*:*:*:*, and the independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable, unauthenticated exploitation with low confidentiality, integrity, and availability impact rather than full compromise. No public exploit identified at time of analysis, and the practical risk is moderate because blind extraction is slow and noisy, making large-scale data theft time-consuming and more detectable than error-based injection.

Blind SQL injection in the WP BASE Booking WordPress plugin (all versions through 6.4.0) allows an authenticated attacker to inject arbitrary SQL into a plugin query and exfiltrate database contents one bit at a time by observing response timing or boolean behavior. The vendor advisory from Patchstack rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L); our independent review keeps the same authenticated, network-reachable, no-user-interaction profile but narrows the realistic impact to confidentiality only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), since the injected queries read data rather than alter it. Because exploitation requires an account on the target site (PR:L), sites with open self-service registration or reachable low-privilege roles carry materially greater exposure, while sites with no untrusted accounts are largely insulated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is not confirmed as actively exploited; EPSS data was not provided. The vulnerable parameter and the minimum required role are not specified in the available data.

Unauthenticated blind SQL injection in the WordPress plugin WP BASE Booking (wp-base-booking-of-appointments-services-and-events) in all versions up to and including 6.4.0 lets remote attackers inject arbitrary SQL into database queries by manipulating request parameters handled by the plugin. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special configuration are required - any site with the plugin installed and reachable over the network is exposed, and exploitation is limited only by the fact that the injection is blind, so data must be extracted through boolean or time-based inference rather than direct query output. Patchstack rates this Critical (9.3) with a scope change, and the upstream advisory is the only public reference; no public exploit code and no CISA KEV entry were identified at time of analysis.

Unauthenticated SQL injection in OrdaSoft Joomla CCK before 8.3.16 allows remote attackers to execute arbitrary SQL via the user-supplied order column for records, compromising the confidentiality, integrity, and availability of the Joomla database. The flaw affects only sites that have installed this third-party CCK extension, so prevalence is the main limiting factor; no public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation. With a CVSS 4.0 score of 9.3 and an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:H/A:H, this is a high-priority issue for affected deployments.

Blind SQL injection in the Sirv WordPress plugin through version 8.2.5 allows an authenticated low-privilege user to execute crafted SQL queries against the underlying WordPress database, potentially exposing sensitive data. The attack is network-reachable, requires no user interaction, and is limited by the need for a valid low-privilege WordPress session and an active vulnerable plugin installation; the specific injectable parameter is not named in the available data. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor CVSS 3.1 score is 8.5.

Blind SQL injection in the Groundhogg WordPress plugin (versions through 4.8.3) allows an authenticated high-privilege user - an administrator, or any account granted Groundhogg admin capabilities - to inject SQL into a plugin query and extract data from the underlying WordPress database. The flaw is network-reachable with low attack complexity and requires no victim interaction, but the PR:H metric means an attacker must already hold elevated credentials, which sharply limits who can exploit it; there is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. The reporting source scored this 7.6, whereas independent assessment rates it lower (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, ~4.9) because the injection is blind, read-only in effect, and gated behind admin-level access - a genuine but conditional risk rather than a drop-everything emergency.

SQL injection in FineAdmin v1.0 allows attackers to reach the /Permissions/Button/List endpoint and inject crafted SQL through the field/order (sort) parameter handled by ButtonService.GetListByFilter(), exposing sensitive database contents. Publicly available exploit code exists (an author-published proof-of-concept write-up is referenced), but there is no confirmed active exploitation (CISA KEV), and EPSS is very low at 0.15% (4th percentile), reflecting the product's obscure, small deployment footprint. The vendor-supplied CVSS of 9.8 (PR:N) conflicts with the assessed vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, which assumes the attacker realistically needs an authenticated admin or back-office session because the affected function is an administrative permissions/button-management feature - that authentication prerequisite is the key limiting factor defenders should verify rather than the headline score.

SQL injection in GouGuOA 6.0.5 and earlier allows an attacker who can reach the /home/message/rubbish endpoint to inject arbitrary SQL through the keywords parameter, yielding full compromise of confidentiality, integrity and availability of the backend database (CWE-89, CVSS 3.1 base 9.8 as reported). The MITRE-supplied vector rates it unauthenticated (PR:N/UI:N), but our independent assessment lowers the privilege metric to PR:L because /home/message/rubbish is a message trash/recycle-bin function that in typical OA deployments is only reachable after login, so a valid session may in practice be a prerequisite - this materially changes the realistic attack surface and should be verified against the referenced write-up. No public exploit code has been confirmed and the CVE is not listed in CISA KEV, though a public technical write-up exists at the referenced GitHub repository; no EPSS score was available in the input, so no probability estimate is asserted.

Blind SQL injection in the Unlimited Elements For Elementor plugin (versions up to 2.0.20) allows remote attackers to extract sensitive information from the WordPress database by inferring query results. The CVSS vector indicates unauthenticated exploitation (PR:N) with no user interaction, but the specific vulnerable endpoint and whether authentication is truly not required remain unconfirmed. No public exploit code has been identified, and the issue is not known to be actively exploited.

Authenticated SQL injection in the Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management plugin (Pro edition) affects all versions up to and including 8.97.0, letting any account at subscriber level or above append arbitrary SQL to an existing query through the 'access_privileges' parameter and read sensitive data from the WordPress database. Exploitation is not unconditional: the site must also be in a non-default state where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, which causes the authorization filter to implicitly permit low-privilege users to reach the vulnerable handler. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); note that while the supplied CVSS 3.1 vector is 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment rates effective severity lower (AC:H, I:L, A:N) because default installations and correctly configured deny-lists are not exploitable, valid authentication is mandatory, and only Pro-edition sites are in scope.

Unauthenticated SQL injection in the WP Visitor Statistics (Real Time Traffic) WordPress plugin through 8.7 lets any remote client poison the wp_logVisit table by submitting a crafted referrer URL to the wmcTrack tracking endpoint; the injected SQL then fires inside the session of an administrator who opens the Traffic Sources dashboard, allowing extraction of sensitive data such as user password hashes and stored configuration secrets. The impact is confidentiality-only - no integrity or availability effect was assessed - and the attack is second-order, so it remains dormant until a privileged user views the affected report. This is a genuine but conditional risk rather than an emergency: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector (UI:R) reflects that a privileged victim must open the dashboard for the payload to execute.

Unauthenticated SQL injection in the SaveTo Wishlist Lite WordPress plugin before 1.1.5 allows remote attackers to append arbitrary SQL queries to the ORDER BY clause of a database query, enabling extraction of sensitive information from the WordPress database. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and there is no indication of active exploitation (CISA KEV not listed). The vendor has released a patch in version 1.1.5.

SQL injection in the GeoDirectory WordPress plugin (all versions up to and including 2.8.186) allows an attacker holding a Subscriber-level account or higher to store a crafted payload in a listing's latitude/longitude coordinate fields and then trigger it through the public wp_ajax_nopriv_geodir_widget_listings AJAX handler, resulting in arbitrary SQL being appended to existing queries and disclosure of sensitive database contents. Successful exploitation requires the attacker to create and own a listing (pending state) whose coordinates are saved without numeric validation or escaping, then request the handler with set_post=<their-listings-id> and sort_by=distance_asc; no victim interaction is needed. No public exploit code has been identified at the time of analysis, and the practical risk is conditional: sites that disable open user registration, thereby preventing attackers from obtaining Subscriber accounts, are substantially protected.

Authenticated JPQL injection in UTMStack SIEM deployments before 11.2.16 lets any holder of a low-privilege account read arbitrary database entities through the GET /api/utm-network-scans/searchPropertyValues endpoint, including sensitive credential tables such as jhi_user. The flaw is reachable by remote attackers (CVSS:4.0 AV:N/PR:L, assessed equivalently as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), so exploitation is confined to malicious insiders or attackers who have already obtained a valid credential - no unauthenticated internet path or non-default configuration is required beyond an authenticated session. No public exploit code has been identified and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis; the primary risk is direct confidentiality loss, not data integrity or availability, and vendor-released patch 11.2.16 is available.

Authenticated SQL injection in UTMStack before 11.2.16 lets any valid low-privilege logged-in user execute arbitrary SQL against the backend PostgreSQL database via the assetType and groupName parameters of GET /api/utm-asset-groups/searchGroupsByFilter. Because the database connection runs with DBA (PostgreSQL superuser-class) privileges, successful exploitation extends from full read and modification of stored data to potential filesystem access on the host. The vendor has released a fix in v11.2.16; no public exploit code has been identified at time of analysis, and the main practical constraint is that an authenticated session is required. Reported by VulnCheck, and tracked as CWE-89.

Authenticated SQL injection in GG Soft Software Services Inc.'s Paperwork (versions through 2026-09-09) lets a logged-in low-privileged user inject arbitrary SQL through network-reachable input, giving high confidentiality impact on stored data (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The PR:L prerequisite means the attacker must already hold a valid Paperwork account before the injection can be triggered, and the low integrity rating indicates limited write capability rather than broad database manipulation. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the flaw was reported by TR-CERT.

SQL injection in YesWiki before 4.6.7 allows an attacker with page-write access - which the supplied CVSS 4.0 vector (PR:N) rates as unauthenticated on default installations - to inject a UNION subquery through the Bazar nuagetag action's tags attribute, exfiltrating password hashes and arbitrary database table contents. The flaw carries a CVSS 4.0 score of 8.8, and an independent assessment confirms high confidentiality impact with low integrity and availability impact. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the vendor has released a patch (4.6.7) and public advisories are available.

Blind SQL injection in YesWiki before 4.6.7 allows unauthenticated remote attackers to read arbitrary database contents, including administrator password hashes from the yeswiki_users table, by planting a crafted option id in an anonymously editable Bazar list and then using {{newtextsearch}} requests as a boolean oracle. Successful exploitation depends on the deployment actually permitting anonymous editing of a Bazar list, and because the technique is blind, extraction is slow and noisy rather than a single-shot dump. Vendor severity is 8.7 (CVSS 4.0, AV:N/AC:L/PR:N/UI:N); our independent assessment, based on CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, confirms a high-confidentiality, no-integrity, no-availability impact with no authentication or user interaction required, and no public exploit code identified at time of analysis, with no evidence of confirmed active exploitation (CISA KEV).

Unauthenticated SQL injection in YesWiki before 4.6.7 allows remote attackers to read arbitrary database contents, including user password hashes, by saving crafted Bazar filtertags markup into a page. The Bazar filtertags action wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause, so a token ending in a backslash breaks quote parity under MySQL/MariaDB escaping and permits a five-column UNION subquery. Exploitation requires a MySQL-family backend and the ability to store filtertags markup - on default installations with open page editing no authentication or user interaction is required - and no public exploit code has been identified at time of analysis; the issue carries a CVSS 8.8 score and is a genuine high-priority flaw, not an inflated rating.

Second-order SQL injection in YesWiki before 4.6.7 allows a low-privileged authenticated user to read database contents and bypass read ACLs by self-registering an account whose username contains a double-quote SQL payload, which AclService::updateRequestWithACL later concatenates unescaped into the read-ACL LIKE clause when a non-admin ACL-filtered listing is loaded. Exploitation requires the instance to permit account self-registration and to accept a username carrying the payload, per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L vector, so instances with self-registration disabled or with strict username validation are substantially harder to attack, and no victim interaction is needed. Although the vendor has released a fix in 4.6.7, no public exploit code has been identified at time of analysis; impact is confined to database read-out and read-ACL bypass rather than write or remote code execution, making this a genuine but moderate-priority issue, not an emergency.

SQL injection in HAVELSAN's Sef - AI Chatbot Platform, affecting all releases prior to 2.1, lets an attacker who holds a valid low-privilege account feed crafted SQL metacharacters through a user-controllable input that is concatenated into a database query, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is network-reachable with low attack complexity and needs no user interaction, but the vector's PR:L means an attacker must first obtain platform credentials; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241) does not disclose the specific vulnerable endpoint or parameter. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, though real-world exposure is bounded by the narrow deployment base of this specific vendor product.

SQL injection in ClipBucket v5 (all versions through 5.5.3-#197) allows an authenticated user who holds the ad_manager_access permission to inject arbitrary SQL through the delete parameter in admin_area/ads_manager.php, which is concatenated unsanitized into the AdsManager::DeleteAd DELETE statement against the ads_data table. A successful attacker can run time-based blind payloads to extract user credentials and email addresses, or directly modify and delete arbitrary records, giving high confidentiality and integrity impact on the application database. Publicly available exploit code exists (a published HackMD write-up), and while the flaw is remotely reachable it is gated behind a privileged admin-area role, so real-world exposure is limited to deployments that hand ad-manager rights to additional or semi-trusted users; no confirmed active exploitation (CISA KEV) has been reported, and an upstream fix is available as a pull request.

Unauthenticated SQL injection in the WordPress File Upload plugin (nickboss) up to and including version 5.1.10 lets any remote attacker who can reach the site inject arbitrary SQL into the plugin's database queries, producing high confidentiality impact on data stored in the WordPress database with only limited integrity impact and no availability impact in our assessment. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms no authentication or user interaction is required and assumes a default installation, so any network-reachable site running the plugin at 5.1.10 or earlier with the injectable endpoint exposed is at risk. Exploitation status: no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Patchstack, which reported the issue, rates it 9.3, higher than our independent assessment, chiefly because the supplied vector claims a scope change and an availability impact we did not substantiate.

Blind SQL injection in the Ultimate Member WordPress plugin (versions through 2.13.1) lets an authenticated high-privilege account - an administrator or an equivalently trusted Ultimate Member role - inject SQL into plugin-supplied input and read database contents one inference at a time. The flaw is network-reachable with low attack complexity and no user interaction, but the CVSS vector (PR:H) means it is realistically an insider-abuse or post-account-compromise scenario rather than an unauthenticated remote attack. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; confidentiality impact is high, while integrity and availability impact are limited to none/low.

Blind SQL injection in the WordPress plugin Captivate Sync (all versions through 3.3.2) allows an authenticated administrator-level user to inject crafted SQL into a plugin parameter and extract database contents through boolean- or time-based inference. The vendor-published score is 7.6, but our independent assessment rates the true impact lower: exploitation requires a high-privilege (PR:H) WordPress account, the injection is blind so no direct query output is returned, and the demonstrated consequence is read-only disclosure of backend data rather than data modification or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be triaged as a moderate-priority, access-gated issue despite the headline CVSS number. It is most relevant to multi-author or managed WordPress installations where untrusted or over-privileged accounts hold administrator rights.

Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis.

Blind SQL injection in the WordPress plugin Unlimited Elements for Elementor (Free Widgets, Addons, Templates) through version 2.0.20 allows an authenticated low-privilege user to read arbitrary data from the site's database by injecting SQL through an unsanitized plugin parameter. Exploitation is network-remote and requires no user interaction, though it does require an account with at least contributor/subscriber-tier privileges (PR:L); because the injection is blind, data extraction is iterative and slower than a direct UNION-based attack but remains reliably automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is concentrated on membership, e-commerce, and multi-author WordPress sites that hand out low-privilege accounts to untrusted users.

SQL injection in the n8n Oracle Database node's Delete Table Drop operation lets an attacker break out of the table or schema identifier with a single quote and append arbitrary SQL, which then runs against the connected Oracle database with the privileges of the stored credential. Affected releases are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 (fixed in 2.39.6 and 2.40.1 respectively); the CVSS vector records PR:N, i.e. unauthenticated, but exploitation is conditional on a workflow that actually uses the Oracle Database node's Delete Table Drop operation with table or schema values sourced from attacker-influenceable input, which is why attack complexity is rated high (AC:H/AT:P) and the issue does not affect a default install with no such workflow. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis.

Unauthenticated filter injection in the n8n Supabase node's 'Filters (String)' mode allows attackers to manipulate PostgREST queries and read, update, or delete all records in connected Supabase tables in a single request. The flaw affects n8n versions before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0, but only when a workflow passes untrusted input to the vulnerable node. No public exploit code has been identified at time of analysis, though a vendor patch is available.

Blind SQL injection in the Grafana datasource endpoint of Pandora FMS 777 and later lets an authenticated console user inject arbitrary SQL through the unsanitized 'module' request parameter and read database contents. Because the endpoint does not return query results directly, exfiltration requires inference-based (boolean or time-based) techniques, and the CVSS 4.0 base score of 7.2 reflects a network-reachable, low-complexity attack with high confidentiality impact (database read) but only limited integrity and availability effects. Exploitation is gated by a valid Pandora FMS session with access to the Grafana datasource integration, so unauthenticated internet attackers cannot exploit a default login-protected deployment directly; no public exploit identified at time of analysis, and this CVE is not in CISA KEV.

Unauthenticated SQL injection in the Pro Like Button WordPress plugin (all versions before 2.0) allows any remote attacker to inject arbitrary SQL through an unsanitized request parameter, giving high-confidentiality read access to data the WordPress database user can reach - typically user credential hashes, private post content, and any other plugin or application tables on the same database. Exploitation needs no authentication, no user interaction, and no special configuration (AV:N/PR:N/UI:N/AC:L), so any site running the vulnerable plugin that is reachable from the internet is exposed; the main limiting factor is the plugin's niche install base rather than any technical obstacle. No public exploit code was identified at time of analysis, and the vendor has released version 2.0 as the fix, per the WPScan advisory, VulDB entry, and ENISA EUVD record.

Unauthenticated SQL injection in the Paytm Payment Gateway WordPress plugin (versions before 2.8.9) lets remote attackers inject arbitrary SQL through payment callback data that the plugin fails to escape before building a database query. Exploitation is conditional: the gateway must be enabled on the WordPress site without payment credentials configured, a specific deployment state in which the plugin's callback integrity/signature check can be forged, so an attacker can supply a crafted, seemingly valid callback. No authentication or user interaction is required once those conditions hold, and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, 7.5 HIGH) reflects high attack complexity and database-scope impact; no public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV), though the pre-2.8.9 install base and internet-facing nature of WordPress sites warrant prompt patching.

Second-order SQL injection in Kiteworks Secure Data Forms (versions below 9.5.1) allows an authenticated, low-privilege user to influence a value derived from their stored account data that is later concatenated into a database query without sanitization, potentially exposing or manipulating data behind the application. Exploitation is condition-gated: the attacker needs a valid session, and only deployments where a specific optional feature is enabled are affected, so installs without that feature are not exploitable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), which keeps this a mid-severity, moderate-priority issue; the vendor has released a fix in 9.5.1.

Stored SQL injection in Kiteworks Core before 9.5.0 allows an authenticated administrator to read sensitive data from the underlying database and to degrade availability of the service. Exploitation is only reachable through the affected administrative reporting feature and requires an existing, authenticated administrative account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the flaw is not exposed to unauthenticated or low-privileged users; no public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score accompanies this CVE. Our independent assessment rates the issue at moderate priority: confidentiality and availability impact are high, but integrity impact is limited (C:H/I:L/A:H), and the mandatory full administrative privilege sharply narrows the realistic attack surface to trusted insiders or attackers who have already compromised an admin session.

Unauthenticated SQL injection in the JCTables extension for Joomla (joomcode.com) through version 1.21.1 lets any remote attacker read and write arbitrary database content, because the extension's front-end CRUD API controller performs neither a Joomla token check nor any authentication check on any task. Table names, column names and values are taken directly from request parameters and concatenated into SQL, so a default install with the extension's front-end endpoint reachable is exploitable by an unauthenticated attacker with no user interaction and no non-default configuration (CVSS 4.0 base 10.0; our independent assessment concurs this is a top-tier priority rather than a high-score/low-risk case). Exposure is limited to Joomla sites that actually have this specific third-party extension installed, and no confirmed public exploit code was identified in the available intelligence at time of analysis, although public research describing a read/write SQLi-to-RCE chain has been published.

Unauthenticated SQL injection in Trex MES (all versions through 2026-09-29) lets a remote attacker reach the application over the network and inject arbitrary SQL into backend database queries, with the reported impact escalating to execution of operating-system commands. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any network-reachable instance of the MES web interface is directly in scope; the practical exposure limit is that this is niche manufacturing-execution software typically deployed on internal or OT-adjacent networks rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor patch version is specified in the available intelligence, so defenders should treat network isolation of the MES interface as the primary risk control while awaiting vendor guidance.

Blind SQL injection in WPTasty Business Directory plugin versions through 6.4.27 allows an authenticated attacker with high privileges to infer database contents without direct query output, using boolean- or time-based inference. The CVSS vector indicates network exploitability, no user interaction, and high confidentiality impact, but the PR:H requirement means the attacker must already hold a privileged WordPress account, so this is a plausible but not urgent priority. No public exploit has been identified at time of analysis, and KEV status is not indicated.

Unauthenticated SQL injection in Dolusoft SOPLOG affects every release before 2026.9.4.1, allowing a remote attacker who can reach a SOPLOG instance to inject arbitrary SQL into the application's backend queries, with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N combined with high confidentiality, integrity, and availability impact producing a 9.8 Critical score. Because the vector carries PR:N and UI:N, no credentials, user interaction, or special configuration are required against a default deployment, so the practical limiting factor is exposure and prevalence rather than technical prerequisites - realistic risk is confined to organizations that actually run SOPLOG, and VPN-only, WAF-fronted, or non-internet-facing instances are substantially harder to reach. No public exploit identified at time of analysis, and the specific vulnerable parameter or endpoint has not been disclosed, which currently prevents defenders from scoping a precise detection or virtual-patch signature.

SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contributor-level account to inject arbitrary SQL into the plugin's media/attachment query handling, reading database content such as user password hashes, private or draft posts, and stored configuration secrets. The issue is remotely exploitable with low complexity and no user interaction, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields a base score of 8.5 (High), reflecting confidentiality-only impact plus a scope change that lets the injection reach tables outside the plugin itself. There is no public exploit identified at time of analysis and no CISA KEV entry, so the practical barrier to abuse is obtaining a Contributor account - realistic on sites with open registration, multi-author blogs, or guest-post/membership setups, but not on locked-down single-admin installs.

Authenticated SQL injection in the Event Tickets WordPress plugin through version 5.29.5 allows any account holding the Contributor role to inject arbitrary SQL through plugin-supplied input, giving read access to data well beyond what the plugin itself stores (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The practical barrier is the Contributor authentication requirement, which limits mass exploitation but is trivially satisfied on sites with open registration or large numbers of low-trust contributors; the Scope:Changed rating reflects that successful injection can expose the broader WordPress database, not just plugin tables. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so this is a genuine mid-to-high priority issue rather than an emergency.

SQL injection in the Category Discount WooCommerce WordPress plugin (slug woo-product-category-discount, CVE-2026-96828) affects all versions up to and including 5.18 and allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's admin-side functionality, yielding high-impact confidentiality exposure (CVSS 7.6, C:H/I:N/A:L, S:C). The PR:H prerequisite is the dominant limiting factor: only the highest-privilege role can reach the vulnerable code, so this is realistically a post-account-compromise or insider-abuse vector rather than an opportunistic unauthenticated attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; Patchstack is credited with reporting the flaw.

SQL injection in the Melapress Admin Notices Manager WordPress plugin (versions up to and including 1.6.0) allows an authenticated WordPress Administrator to inject arbitrary SQL into a plugin-handled parameter, giving the attacker read access to data outside the plugin's own tables. The assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L scores 7.6, but the PR:H requirement means exploitation presupposes top-tier site access; the practical threat model is multi-admin sites, delegated or agency-managed installs, or an attacker who has already escalated a lower-privilege foothold to administrator. No public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the available intelligence, so no exploit-probability estimate is asserted here.

Unauthenticated SQL injection in the WordPress Books Gallery plugin (wp-books-gallery) 4.8.3 and earlier lets a remote attacker read arbitrary data from the site's WordPress database over plain HTTP, with no credentials and no user interaction required. Exposure is limited to sites that actually have this low-adoption plugin installed and activated, and no public exploit code was identified at time of analysis; there is no CISA KEV entry for this issue. Because the assessed impact is high confidentiality with only a low availability effect, the realistic worst case is full database disclosure - user password hashes, private content and configuration secrets - rather than code execution or data tampering.

Authenticated SQL injection in the weDevs WP ERP plugin for WordPress, affecting all releases up to and including 1.17.9, allows an attacker with Author-level or higher WordPress privileges to inject arbitrary SQL and read data from the site's database. The vulnerability is network-reachable and requires no user interaction, and because the CVSS scope is marked as changed (S:C) with high confidentiality impact (C:H), a successful injection can reach data beyond the plugin's own tables, including other plugins' and core WordPress content. Exploitation is privilege-gated by the PR:H rating, so exposure concentrates on multi-author, membership or community sites where Author accounts are handed to third parties; there is no public exploit identified at time of analysis and no confirmed vendor patch version in the available intelligence, making this a genuine but privilege-gated risk.

SQL injection in the Estatik WordPress plugin (versions <= 4.3.5) allows an authenticated attacker with administrator privileges to read sensitive data from the WordPress database. The vulnerability is a CWE-89 SQL injection in an admin-side function, requiring high privileges (PR:H) but no user interaction. No public exploit code has been identified at the time of analysis, and the primary risk is in environments where administrator access is delegated or on multisite installations where raw database access is not otherwise available.

SQL injection in GamiPress WordPress plugin versions 8.0.2 and earlier allows unauthenticated attackers to read sensitive data from the database. Our independent assessment indicates no user interaction or authentication is required (PR:N), though the originally provided CVSS vector specifies PR:L, creating a discrepancy that should be verified with the vendor. No public exploit code has been identified at time of analysis.

Authenticated SQL injection in the Easy Pricing Tables WordPress plugin affects versions up to and including 4.1.2, allowing any account holding at least the Contributor role to inject arbitrary SQL into the site's database and read sensitive data such as user credential hashes, password reset tokens, and stored configuration. Exploitation requires a valid logged-in account with Contributor privileges, needs no user interaction, and is network-reachable; no public exploit code has been identified at time of analysis, and the issue is not reported as actively exploited. Realistic exposure is concentrated on multi-author sites, membership or community sites with open registration granting Contributor, or any site where an attacker can obtain low-privilege credentials, while single-admin sites with registration disabled are at substantially lower risk.

Authenticated SQL injection in the Quiz Cat WordPress plugin (versions 3.1.1 and earlier) allows an attacker holding at least the WordPress Author role to send crafted requests that are woven into backend SQL statements, giving read access to sensitive database contents such as user records and stored quiz data, with secondary potential to alter or disrupt data. Exploitation is remote and requires no user interaction, but it is gated behind the Author privilege, so the realistic exposure surface is multi-author, membership, and user-generated-content sites that hand Author accounts to untrusted or numerous users; anonymous visitors and Subscriber- or Contributor-only accounts cannot trigger it. No public exploit code has been identified at time of analysis. The reported CVSS is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), while our independent assessment is slightly more conservative at AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L - both agree the dominant impact is confidentiality loss.

Unauthenticated SQL injection in the WordPress plugin WP Data Access affects all versions up to and including 5.5.84, allowing remote attackers to inject arbitrary SQL into the site's database queries without logging in or any user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N). The assessed impact is primarily to database confidentiality (C:H) with only limited integrity impact (I:L) and no availability effect, which confines the practical worst case to large-scale data disclosure rather than site takeover or denial of service. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though the low attack complexity and lack of authentication prerequisites make weaponization straightforward; EPSS data was not provided in the source intelligence. This is a genuine priority for any WordPress site running the plugin, since exploitation requires only that the affected version be installed and reachable, with no special configuration needed.

SQL injection in WP Activity Log 5.6.6 and earlier allows an authenticated WordPress administrator to inject SQL through an admin-accessible plugin function, potentially reading sensitive database contents and causing limited integrity or availability impact. The vulnerability requires a high-privileged admin account per the PR:H vector, so it is not exploitable by unauthenticated visitors or lower-privileged users; no public exploit code was identified at time of analysis. The supplied base CVSS is 7.6, and the independent assessment uses CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L, while the provided NVD-style vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L.

Authenticated SQL injection in Moodle's question bank web service allows a low-privilege user to inject unsanitized input into database queries, potentially exposing, modifying, or deleting sensitive data in the underlying database. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning any valid account that can reach the question bank web-service endpoint is a potential vector - exploitation by fully anonymous users is not possible, and the requirement for credentials and for the web service to be enabled/exposed are the main limiting factors. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (14th percentile), and CISA SSVC rates exploitation as none with partial technical impact; this is a credible, exploitable issue but not an emergency.

SQL injection in Digiwin EasyFlow .NET allows an authenticated, low-privilege remote user to read arbitrary contents of the application's backend database. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N), exploitation is network-reachable and low-complexity but requires a valid account (PR:L) and produces high confidentiality impact only - no integrity or availability effect, consistent with a read-only data-exfiltration primitive. The CVSS base score is 7.1; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, and no EPSS score was provided with the source data.

Unauthenticated time-based blind SQL injection in the Motors - Car Dealership & Classified Listings plugin for WordPress (all versions up to and including 1.4.109) lets remote attackers inject SQL through the 'stm_lat' and 'stm_lng' parameters and infer sensitive database contents one timed request at a time. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no account, privileges, or user interaction are needed - only that the plugin is installed and the geo-location endpoint that consumes these latitude/longitude parameters is reachable, which is the case in default configurations. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation is viable but inherently slow and noisy, since each extracted bit requires a distinct delayed response, so the practical risk is slow, stealthy exfiltration of database contents (hashes, user data, listing records) rather than rapid mass compromise.

Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject SQL through the 'reportType' parameter of the product summary report in the balancing reports section, with data recovered indirectly by measuring database response delays rather than returned in the response. The issue is remotely reachable with no user interaction but is gated behind a privileged session (vendor CVSS:4.0 base 8.5; independent assessment CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L), so confidentiality is the primary exposure while integrity and availability impacts remain limited. Exploitation status: no public exploit identified at time of analysis, and the vendor addresses it by upgrading to TMS7 v7.8; taken together this is a genuine but access-gated data-confidentiality issue in a niche OT deployment rather than an internet-wide emergency.

Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated high-privilege user inject SQL through the 'screenID' parameter of the electronic transaction queue viewer in the manual transactions section, using response-time delays to infer database contents. Exploitation requires an existing high-privilege (PR:H) session on the affected web interface, so anonymous and low-privilege users are excluded, and the blind, inference-based technique makes data extraction slow rather than directly returned. No public exploit code has been identified at time of analysis and the issue is remediated in TMS7 version 7.8, so despite the vendor's CVSS 4.0 score of 8.5 the practical operational priority for most terminal operators is moderate.

Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application lets an attacker who already holds a high-privileged session inject SQL through the 'pattern' query parameter and infer database contents from response timing. The vendor addressed the flaw in TMS7 version 7.8, so unpatched pre-7.8 deployments are the exposed population; TOPHAT is also listed in the affected CPE set. The issue requires authenticated high-privileged access (CVSS PR:H) and the product has a limited OT footprint, so this is a real but access-gated concern rather than an internet-scale emergency, and no public exploit identified at time of analysis.

Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech Systems' TMS7 and TopHat terminal-automation platforms, confirmed affecting version 7.6.3, lets an attacker with an authenticated high-privilege session force the backend database to leak data through conditional response delays. Exploitation is access-gated rather than open: the independent assessment (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) aligns with the vendor's v4.0 vector (PR:H) in requiring a privileged, authenticated foothold, and the flaws sit in OT/terminal-management deployments that are normally segmented rather than internet-facing. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has shipped a fix in TMS7 v7.8.

Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and earlier lets a high-privilege authenticated attacker inject SQL through the supplier_no parameter and infer database contents by measuring conditional query delays. The vendor fixed the issue in TMS7 v7.8, documented in CISA ICS advisory ICSA-26-272-02 and tracked as EUVD-2026-89428, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because exploitation requires a privileged authenticated session against the business allocation search endpoint, the issue is access-gated rather than broadly reachable, although the assessed confidentiality and availability impacts on the database are high.