CWE-89: SQL Injection vulnerabilities

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

CVE-2026-62117 is a high severity SQL Injection vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager affecting versions up to and including 1.13.1. The flaw allows improper neutralization of special elements in SQL commands, potentially enabling an attacker with low privileges to execute unauthorized database queries. This vulnerability impacts confidentiality and availability but does not affect integrity. No patch or remediation information is currently provided.

CVE-2026-62031 is a critical SQL Injection vulnerability affecting Stylemix uListing versions up to and including 2.2.0. It allows unauthenticated attackers to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to high confidentiality impact and low availability impact, with no integrity impact reported.

CVE-2026-45440 is a high severity SQL Injection vulnerability affecting WP Ultimate CSV Importer versions up to 9.2. It allows an authenticated administrator to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to data confidentiality breaches and partial denial of service. No specific affected versions beyond "<= 9.2" are provided, and no patch or remediation details are available in the input data.

CVE-2026-42722 is a high-severity SQL Injection vulnerability affecting Frontend Admin by DynamiApps versions up to and including 3.29.13. The flaw allows an administrator-level user to inject SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to high confidentiality impact and limited availability impact but does not affect integrity. No public exploits are known, and no patch information is currently available.

CVE-2026-42717 is a high-severity SQL Injection vulnerability affecting VaultDweller's Leyka product versions up to and including 3.32.3. The flaw allows an administrator-level user to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability has a CVSS score of 7.6, indicating a significant risk primarily to confidentiality and availability. No official patch or remediation details are provided, and no known exploits are reported in the wild.

CVE-2026-42712 is a high severity SQL Injection vulnerability affecting Qode Tours versions up to and including 3.1.3.2. The flaw involves improper neutralization of special elements in SQL commands, specifically in the subscriber functionality. This vulnerability could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to data confidentiality breaches and partial service disruption.

CVE-2026-42633 is a high severity SQL Injection vulnerability affecting Marcus Events Manager versions up to 7.4.6. It involves improper neutralization of special elements in SQL commands related to subscriber data, allowing an attacker with low privileges to execute unauthorized SQL queries. This vulnerability can lead to complete compromise of confidentiality and partial impact on availability, but no integrity loss is indicated.

CVE-2026-40800 is a critical SQL Injection vulnerability in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes versions up to and including 1.5.3. It allows an unauthenticated attacker to inject malicious SQL commands, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation information is provided yet.

WP Directory Kit versions up to 1.5.9 contain a time-based SQL Injection vulnerability in the 'display_name' profile field. Authenticated users with subscriber-level access can exploit this second-order injection by storing malicious input that is later unsanitized and executed in SQL queries, potentially exposing sensitive database information.

The Appointment Booking Plugin – LatePoint for WordPress contains a SQL Injection vulnerability in the 'booking[service_id]' parameter. This affects all versions up to and including 5.7.2. The flaw allows unauthenticated attackers to inject additional SQL commands due to insufficient input escaping and query preparation, potentially exposing sensitive database information. The vulnerability has a high severity score of 7.5 and does not require user interaction or privileges to exploit.

The WP Booking System – Booking Calendar WordPress plugin is vulnerable to a time-based SQL Injection via the 'current_month' parameter in all versions up to and including 2.1.0.1. This vulnerability allows authenticated users with subscriber-level access or higher to inject additional SQL queries due to insufficient input escaping and lack of proper query preparation. The issue is a regression caused by the removal of a capability check introduced in earlier versions to address a previous vulnerability. This flaw can lead to unauthorized extraction of sensitive database information without requiring user interaction.

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.

The Smart Popup by Supsystic WordPress plugin is vulnerable to SQL Injection via the 'sidx' parameter in versions up to and including 1.13.2. This vulnerability allows authenticated users with administrator-level privileges to inject additional SQL queries due to insufficient input escaping and lack of proper query preparation. The vulnerability has a medium severity rating with a CVSS score of 4.9.

The FireBox – WooCommerce Popup Builder plugin for WordPress contains an SQL Injection vulnerability in the FireBox Form Display Condition feature. This affects all versions up to and including 3.1.13. Authenticated attackers with author-level access or higher can exploit this flaw to append additional SQL queries, potentially extracting sensitive database information. On fresh installs of version 3.1.10 and later, exploitation requires administrator-level access, but on upgraded sites from versions prior to 3.1.10, the required privilege is reduced to author-level due to a migration issue.

JetBrains Exposed versions before 1.5.1 are vulnerable to SQL injection due to unescaped string arguments in several SQL functions. This vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability. The issue is tracked as CVE-2026-108474 and has a critical severity with a CVSS score of 9.8. A fixed version, 1.5.1, is available to remediate this vulnerability.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0.

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.