SQL Injection vulnerabilities in WordPress plugins and themes

SQL injection happens when input from a request is placed into a database query without being separated from the query itself. An attacker who controls that input controls the query, which in practice means reading the whole database — every user row, every password hash, every stored order. It is the highest-consequence flaw class on this list because the database is where everything worth stealing lives.

What an attacker can do: read, alter or delete anything in the site database, including user accounts and password hashes CWE-89

Wpforo - SQL Injection (CVE-2026-5097) HIGH 2026-08-28
Suggestion Engine for WooCommerce - SQL Injection (CVE-2026-81277) HIGH 2026-08-27
Beautiful Taxonomy Filters - SQL Injection (CVE-2026-78288) CRITICAL 2026-08-27
Like Button Rating - SQL Injection (CVE-2026-78285) HIGH 2026-08-27
Epayco - SQL Injection (CVE-2026-78260) CRITICAL 2026-08-27
Custom Post Types - SQL Injection (CVE-2026-32564) HIGH 2026-08-27
Kadence Shop Kit - SQL Injection (CVE-2026-32550) HIGH 2026-08-27
Visitor Traffic Real Time Statistics Pro - SQL Injection (CVE-2026-32479) CRITICAL 2026-08-27
Woocommerce Lottery - SQL Injection (CVE-2026-18884) HIGH 2026-08-26
Registrationmagic - SQL Injection (CVE-2026-77790) UNKNOWN 2026-08-26
Tutor Lms - SQL Injection (CVE-2026-19094) MEDIUM 2026-08-26
And Crm Solution - SQL Injection (CVE-2026-78468) MEDIUM 2026-08-25
Media Sweep - SQL Injection (CVE-2026-77824) MEDIUM 2026-08-25
All In One Wp Migration - SQL Injection (CVE-2026-19949) HIGH 2026-08-25
Readabler - SQL Injection (CVE-2026-78576) HIGH 2026-08-25
Total Donations - SQL Injection (CVE-2026-78568) CRITICAL 2026-08-25
Wp Project Manager Pro - SQL Injection (CVE-2026-78470) MEDIUM 2026-08-25
Events Manager - SQL Injection (CVE-2026-15023) MEDIUM 2026-08-25
Boost - SQL Injection (CVE-2026-32555) CRITICAL 2026-08-24
WooBeWoo Product Filter Pro - SQL Injection (CVE-2026-32554) CRITICAL 2026-08-24
FluentCRM Pro - SQL Injection (CVE-2026-78270) HIGH 2026-08-24
Woo Essential - SQL Injection (CVE-2026-32551) CRITICAL 2026-08-24
WP Project Manager Pro - SQL Injection (CVE-2026-32478) HIGH 2026-08-24
ProLancer Element - SQL Injection (CVE-2026-32471) HIGH 2026-08-24
Media Library Assistant - SQL Injection (CVE-2026-16959) MEDIUM 2026-08-21
Link Whisper Free - SQL Injection (CVE-2026-14601) MEDIUM 2026-08-21
CVE-2026-74011 HIGH 2026-08-20
eShipper Commerce - SQL Injection (CVE-2026-74013) HIGH 2026-08-20
WP w3all phpBB - SQL Injection (CVE-2026-73998) HIGH 2026-08-20
BookingPress Appointment Booking Pro - SQL Injection (CVE-2026-68566) CRITICAL 2026-08-20

Browse the full threat database