CWE-89: SQL Injection vulnerabilities

Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.

Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.

Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.

Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.

CVE-2026-39795 is a critical SQL Injection vulnerability in brewlabs SendPress Newsletters (versions up to 1.26.1.20). It allows an unauthenticated attacker to perform blind SQL injection, potentially leading to high confidentiality impact and partial denial of service. No public exploits or patches are currently documented.

CVE-2026-39785 is a critical SQL Injection vulnerability in Serhii Pasyuk's Gmedia Photo Gallery affecting versions up to 1.25.1. The flaw allows an attacker to perform Blind SQL Injection due to improper neutralization of special elements in SQL commands. This vulnerability can lead to high confidentiality impact and partial availability impact without requiring user interaction or privileges.

Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19 versions.

CVE-2026-39747 is a high severity SQL Injection vulnerability in WofficeIO's Woffice product. It affects all versions prior to 5.4.43. The flaw involves improper neutralization of special elements in SQL commands, which could allow an attacker with low privileges to execute unauthorized SQL queries. The vulnerability has been fixed in version 5.4.43.

CVE-2026-39746 is a critical Blind SQL Injection vulnerability in Booknetic versions prior to 5.10.3. It allows an unauthenticated attacker to inject SQL commands due to improper neutralization of special elements in SQL queries. This flaw affects confidentiality and availability but does not impact integrity. The issue is fixed in version 5.10.3.

Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.

Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.

CVE-2026-32557 is a critical SQL Injection vulnerability in BookingWP WooCommerce Appointments plugin versions up to 5.3.2. It allows an attacker to perform Blind SQL Injection due to improper neutralization of special elements in SQL commands. This vulnerability can lead to high confidentiality impact and low availability impact without requiring user interaction or privileges.

Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.

SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.

An unauthenticated SQL injection vulnerability exists in OrdaSoft Joomla CCK versions up to and including 8.3.15. The flaw arises because the order column for records is user-controlled and not properly validated, allowing attackers to inject malicious SQL commands. This vulnerability has a critical severity rating with a CVSS score of 9.3.

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This exploit is only possible on installations where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, as this condition allows the authorization filter to implicitly permit Subscriber-level users to invoke the vulnerable handler.

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an unauthenticated attacker submits a crafted referrer URL to the wmcTrack tracking endpoint, which persists the raw unescaped value into the wp_logVisit table, and the injection is triggered when an administrator next views the Traffic Sources dashboard.