CWE-89: SQL Injection vulnerabilities

Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.

Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.

Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector.

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector.

The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable keys originate from the 'settings' object in an attacker-controlled import file processed via file_get_contents() or base64-decoded/JSON-decoded blobs, bypassing wp_magic_quotes protections entirely; two distinct sinks are affected — _save_setting() in Model.php and insert_form_meta() in ImportForm.php — as only the value side is escaped while the key side receives no sanitization or parameterization at any point in the call chain.

CVE-2026-63359 is a critical SQL injection vulnerability in Appriss Insights' Victim Information Notification Exchange (VINE) application. It allows unauthenticated attackers to bypass the login page, access other users' credentials, take over accounts, and extract sensitive personally identifiable information (PII) from the database. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact with no required privileges or user interaction. No patch or official remediation guidance is currently available.

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.

Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.

Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.

Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

Contributor SQL Injection in MapSVG <= 8.14.0 versions.

Contributor SQL Injection in MapSVG <= 8.14.0 versions.

Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.

Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.