CVE-2026-42713: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Gopiplus Post title marquee scroll

This vulnerability involves improper neutralization of special elements in SQL commands within the Gopiplus Post title marquee scroll plugin, enabling blind SQL injection attacks. The affected versions range from 0 up to and including 9.9. The CVSS 3.1 score is 7.6, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

An attacker with high privileges can exploit this blind SQL injection vulnerability to extract sensitive information from the database, compromising confidentiality. The vulnerability does not impact data integrity but may cause limited denial of service. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates and consider restricting access to the affected plugin until a fix is available.