SQL injection in WordPress plugins

SQL injection happens when a plugin puts user input straight into a database query. An attacker can then change the query to read data it was never meant to return, and sometimes to change it.

In WordPress that usually means reading the users table, including password hashes and email addresses. With a hash an attacker can try to crack the admin password offline. Records marked “no login needed” are the ones automated scanners go after first.

What to do: update to the fixed version right away. If you ran a vulnerable version on a site where anyone can reach the affected feature, change admin passwords, and check Users for accounts you do not recognise.

Worried a plugin bug was used on your site?

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Newest SQL injection records

1,405 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

high 7.2 Advanced Shipment Tracking for WooCommerce

SQL injection

CVE-2026-120558 · affected 3.9 and older · fixed in 3.9.1 * · published 2026-11-03
medium 4.9 WPML Multilingual & Multicurrency for WooComme…

SQL injection

CVE-2026-120563 · affected 5.5.7 and older · fixed in 5.5.8 * · published 2026-11-03
critical 9.3 Bookit

SQL injection

CVE-2026-62048 · affected 2.6.0.6 and older · fixed in 2.6.0.7 · published 2026-11-01
high 7.5 WP Directory Kit

SQL injection

CVE-2026-109197 · affected 1.6.0 and older · fix not stated · published 2026-10-31
medium 5.3 Newsletters

SQL injection

CVE-2026-101325 · affected 4.18.1 and older · fixed in 4.18.2 * · published 2026-10-31
medium 6.5 WP2LEADS

SQL injection

CVE-2025-9462 · affected 3.5.6 and older · fixed in 3.5.12 * · published 2026-10-31
high 7.5 FunnelKit Automations

SQL injection

CVE-2026-119163 · affected 3.8.5.2 and older · fixed in 3.8.6 * · published 2026-10-31
critical 9.3 Transliterator

SQL injection

CVE-2026-39732 · affected 2.5.13 and older · fixed in 2.5.14 · published 2026-10-30
medium 6.5 Majestic Support

SQL injection

CVE-2026-115820 · affected 1.2.2 and older · fixed in 1.2.3 * · published 2026-10-30
medium 6.5 JoomSport

SQL injection

CVE-2026-118698 · affected 5.7.14 and older · fixed in 5.7.15 * · published 2026-10-30
medium 4.1 WP Visitor Statistics (Real Time Traffic)

SQL injection

CVE-2026-117572 · affected older than 8.8 · fixed in 8.8 · published 2026-10-30
high 8.5 BuddyPress

SQL injection

CVE-2026-115965 · affected 14.5.2 and older · fixed in 14.5.3 · published 2026-10-29
critical 9.3 Motors

SQL injection

CVE-2026-115964 · affected 1.4.126 and older · fixed in 1.4.127 · published 2026-10-29
medium 6.5 JoomSport

SQL injection

CVE-2026-118192 · affected 5.7.11 and older · fixed in 5.7.14 * · published 2026-10-29
high 7.5 Social Web Suite

SQL injection

CVE-2026-93904 · affected 4.1.12 and older · fix not stated · published 2026-10-29
high 7.5 SendPress Newsletters

SQL injection

CVE-2026-93855 · affected 1.26.1.20 and older · fix not stated · published 2026-10-29
high 8.5 BuddyPress

SQL injection

CVE-2026-111850 · affected 14.5.2 and older · fixed in 14.5.3 · published 2026-10-28
critical 9.3 DXP ToolKit

SQL injection

CVE-2026-115607 · affected 2.0.1 and older · fixed in 2.0.2 · published 2026-10-28
critical 9.3 FunnelKit Automations

SQL injection

CVE-2026-111411 · affected 3.8.5.2 and older · fixed in 3.8.6 · published 2026-10-28
medium 6.5 WP Inventory Manager

SQL injection

CVE-2026-76005 · affected 2.5.5 and older · fixed in 2.5.6 * · published 2026-10-28
medium 6.5 VikRentCar Car Rental Management System

SQL injection

CVE-2026-116750 · affected 1.4.10 and older · fixed in 1.4.11 * · published 2026-10-28
medium 6.5 WP Visitor Statistics (Real Time Traffic)

SQL injection

CVE-2026-116609 · affected 8.8 and older · fixed in 8.9 * · published 2026-10-28
medium 4.1 Customer Engagement System

SQL injection

CVE-2026-115224 · affected older than 2.0.2 · fixed in 2.0.2 · published 2026-10-28
medium 6.8 Recipe Card Blocks Lite

SQL injection

CVE-2026-115281 · affected 3.5.0 up to (not including) 3.6.4 · fixed in 3.6.4 · published 2026-10-28
medium 6.8 Welcart e-Commerce

SQL injection

CVE-2026-111027 · affected older than 2.12.6 · fixed in 2.12.6 · published 2026-10-28
high 8.5 Media Library Assistant

SQL injection

CVE-2026-115948 · affected 3.42 and older · fixed in 3.43 · published 2026-10-26
critical 9.3 Product Filter for WooCommerce by WBW

SQL injection

CVE-2026-112866 · affected 3.4.6 and older · fixed in 3.4.7 · published 2026-10-24
critical 9.3 Newsletters

SQL injection

CVE-2026-111402 · affected 4.18.1 and older · fixed in 4.18.2 · published 2026-10-24
high 8.5 GamiPress

SQL injection

CVE-2026-112837 · affected 8.0.7 and older · fixed in 8.0.8 · published 2026-10-23
critical 9.3 Participants Database

SQL injection

CVE-2026-112860 · affected 2.7.8.5 and older · fix not stated · published 2026-10-23
critical 9.3 Booking for Appointments and Events Calendar

SQL injection

CVE-2026-112327 · affected 2.4.11 and older · fixed in 2.4.12 · published 2026-10-22
critical 9.3 Ajax Search Lite

SQL injection

CVE-2026-111852 · affected 4.14.6 and older · fixed in 4.14.7 · published 2026-10-21
high 8.5 Support Genix

SQL injection

CVE-2026-110895 · affected 1.4.54 and older · fixed in 1.4.55 · published 2026-10-18
critical 9.3 Booktics

SQL injection

CVE-2026-109894 · affected 1.0.29 and older · fixed in 1.0.30 · published 2026-10-18
medium 6.8 BSK PDF Manager

SQL injection

CVE-2026-91074 · affected 3.8.1 and older · fix not stated · published 2026-10-17
medium 4.9 Welcart e-Commerce

SQL injection

CVE-2026-107752 · affected 2.12.4 and older · fixed in 2.12.5 * · published 2026-10-17
high 8.5 MapSVG

SQL injection

CVE-2026-111399 · affected 8.16.1 and older · fixed in 8.16.2 · published 2026-10-16
high 7.5 Vitepos

SQL injection

CVE-2026-92766 · affected 3.5.1 and older · fixed in 3.6.0 * · published 2026-10-16
medium 4.9 WP Booking System

SQL injection

CVE-2026-111178 · affected 2.1.0.1 and older · fixed in 2.1.0.2 * · published 2026-10-16
medium 6.8 affiliate-toolkit

SQL injection

CVE-2026-110179 · affected older than 3.8.9 · fixed in 3.8.9 · published 2026-10-16
medium 6.8 Mobile builder

SQL injection

CVE-2026-103696 · affected 1.4.2 and older · fix not stated · published 2026-10-16
medium 6.5 Vitepos

SQL injection

CVE-2026-109414 · affected 3.6.1 and older · fixed in 3.6.2 * · published 2026-10-16
medium 6.5 Mail Mint

SQL injection

CVE-2026-111106 · affected 1.31.4 and older · fixed in 1.31.5 * · published 2026-10-16
high 8.0 Backuply

SQL injection

CVE-2026-93953 · affected 1.5.8 and older · fixed in 1.5.9 * · published 2026-10-16
medium 4.9 FluentCart

SQL injection

CVE-2026-103518 · affected 1.7.0 and older · fixed in 1.7.1 * · published 2026-10-16
critical 9.3 Mang Board

SQL injection

CVE-2026-109698 · affected 2.4.4 and older · fixed in 2.4.5 · published 2026-10-15
critical 9.3 Link Whisper Free

SQL injection

CVE-2026-109688 · affected 0.9.7 and older · fixed in 0.9.8 · published 2026-10-15
critical 9.3 Booking for Appointments and Events Calendar

SQL injection

CVE-2026-108497 · affected 2.4.10 and older · fixed in 2.4.11 · published 2026-10-15
high 7.5 Link Library

SQL injection

CVE-2026-15090 · affected 7.9.2 and older · fixed in 7.9.3 * · published 2026-10-15
high 8.5 Modern Events Calendar Lite

SQL injection

CVE-2026-105067 · affected older than 7.37.0 · fixed in 7.37.0 · published 2026-10-14
high 8.5 CP Multi View Events Calendar

SQL injection

CVE-2026-109901 · affected 1.4.41 and older · fixed in 1.4.42 · published 2026-10-14
medium 6.5 Hyyan Integration for WooCommerce and Polylang

SQL injection

CVE-2026-101926 · affected 1.5.0 and older · fixed in 1.6.0 * · published 2026-10-14
high 7.5 Gmedia Photo Gallery

SQL injection

CVE-2026-96661 · affected 1.25.1 and older · fixed in 1.25.2 * · published 2026-10-14
high 7.5 Form Maker by 10Web

SQL injection

CVE-2026-95808 · affected 1.15.48 and older · fixed in 1.15.49 * · published 2026-10-14
high 7.5 JTL-Connector for WooCommerce

SQL injection

CVE-2026-78193 · affected 2.4.3 and older · fix not stated · published 2026-10-14
high 7.6 Link Whisper Free

SQL injection

CVE-2026-109687 · affected 0.9.7 and older · fixed in 0.9.8 · published 2026-10-13
high 7.6 WOLF

SQL injection

CVE-2026-108179 · affected 1.1.1 and older · fixed in 1.1.2 · published 2026-10-13
medium 4.9 Animated Number Counters

SQL injection

CVE-2026-15399 · affected 3.0 and older · fixed in 3.1 * · published 2026-10-13
high 8.6 Social Web Suite

SQL injection

CVE-2026-88930 · affected 4.1.12 and older · fix not stated · published 2026-10-11
high 8.6 Mobile builder

SQL injection

CVE-2026-103695 · affected 1.4.2 and older · fix not stated · published 2026-10-11
high 8.5 Barcode Scanner (+Mobile App)

SQL injection

CVE-2026-62117 · affected 1.13.1 and older · fixed in 1.13.6 · published 2026-10-10
critical 9.3 affects latest 2.2.0 Directory Listings WordPress plugin

SQL injection

CVE-2026-62031 · affected 2.2.0 and older · no fix listed yet · published 2026-10-10
high 7.6 ACF Frontend Admin by DynamiApps

SQL injection

CVE-2026-42722 · affected 3.29.13 and older · fixed in 3.30.0 * · published 2026-10-10
high 7.6 WP Ultimate CSV Importer

SQL injection

CVE-2026-45440 · affected 9.2 and older · fixed in 9.3 * · published 2026-10-10
high 7.6 Leyka

SQL injection

CVE-2026-42717 · affected 3.32.3 and older · fix not stated · published 2026-10-10
high 8.5 Events Manager

SQL injection

CVE-2026-42633 · affected 7.4.6 and older · fixed in 7.4.7 · published 2026-10-10
critical 9.3 ELEX WooCommerce Bulk Edit Products, Prices &…

SQL injection

CVE-2026-40800 · affected 1.5.3 and older · fixed in 1.5.4 * · published 2026-10-10
critical 9.3 Tickera

SQL injection

CVE-2026-105889 · affected 3.6.0.6 and older · fixed in 3.6.0.7 · published 2026-10-10
high 7.5 Appointment Booking Plugin

SQL injection

CVE-2026-96662 · affected 5.7.2 and older · fixed in 5.7.3 * · published 2026-10-10
medium 6.5 WP Directory Kit

SQL injection

CVE-2026-96653 · affected 1.5.9 and older · fix not stated · published 2026-10-10
medium 6.5 WP Booking System

SQL injection

CVE-2026-107712 · affected 2.1.0.1 and older · fixed in 2.1.0.2 * · published 2026-10-10
medium 4.1 Rank Math SEO

SQL injection

CVE-2026-104753 · affected older than 1.0.280 · fixed in 1.0.280 · published 2026-10-10
medium 4.9 Customer Engagement System

SQL injection

CVE-2026-104023 · affected 1.13.2 and older · fixed in 1.13.3 * · published 2026-10-10
medium 5.3 FireBox

SQL injection

CVE-2026-104724 · affected 3.1.13 and older · fixed in 3.1.14 * · published 2026-10-10
critical 9.3 EduAdmin Booking

SQL injection

CVE-2026-96809 · affected older than 6.0.0 · fixed in 6.0.0 · published 2026-10-09
high 8.5 Taskbuilder

SQL injection

CVE-2026-95599 · affected 6.0.5 and older · fixed in 6.0.6 · published 2026-10-09
high 8.5 ProfileGrid

SQL injection

CVE-2026-94663 · affected 6.0.0.2 and older · fixed in 6.0.0.3 · published 2026-10-09
medium 6.8 Code Snippets

SQL injection

CVE-2026-106097 · affected older than 3.10.0 · fixed in 3.10.0 · published 2026-10-09
high 7.6 Vitepos

SQL injection

CVE-2026-105076 · affected 3.6.1 and older · fixed in 3.6.2 · published 2026-10-08
critical 9.3 WP Data Access

SQL injection

CVE-2026-95605 · affected 5.5.82 and older · fixed in 5.5.83 · published 2026-10-07
high 7.6 affects latest 1.2.63 Slider by 10Web

SQL injection

CVE-2026-42710 · affected 1.2.63 and older · no fix listed yet · published 2026-10-07
high 7.6 WP Post Author

SQL injection

CVE-2026-42708 · affected 4.0.0 and older · fixed in 4.0.1 · published 2026-10-07
high 7.6 affects latest 2.1.2 Pix por Piggly (para Woocommerce)

SQL injection

CVE-2026-42714 · affected 2.1.2 and older · no fix listed yet · published 2026-10-07
high 7.6 Post title marquee scroll

SQL injection

CVE-2026-42713 · affected 9.9 and older · fix not stated · published 2026-10-07
high 7.6 affiliate-toolkit

SQL injection

CVE-2026-42721 · affected 3.9.1 and older · fixed in 3.9.2 * · published 2026-10-07
high 7.6 affects latest 2.4 Dynamic User Directory

SQL injection

CVE-2026-42720 · affected 2.4 and older · no fix listed yet · published 2026-10-07
medium 6.8 Animated Number Counters

SQL injection

CVE-2026-104667 · affected older than 3.1 · fixed in 3.1 · published 2026-10-07
critical 9.3 affects latest 1.5.9 Newsletter Subscription Form

SQL injection

CVE-2026-41555 · affected 1.5.9 and older · no fix listed yet · published 2026-10-06
critical 9.3 SendPress Newsletters

SQL injection

CVE-2026-39795 · affected 1.26.1.20 and older · fix not stated · published 2026-10-06
critical 9.3 Gmedia Photo Gallery

SQL injection

CVE-2026-39785 · affected 1.25.1 and older · fixed in 1.25.2 * · published 2026-10-06
critical 9.3 Radius Booking

SQL injection

CVE-2026-39764 · affected 1.0.19 and older · fixed in 1.0.20 * · published 2026-10-06
high 7.1 affects latest 4.16.2 Mooberry Book Manager

SQL injection

CVE-2026-32581 · affected 4.16.2 only · no fix listed yet · published 2026-10-06
high 8.5 Paid Membership Subscriptions

SQL injection

CVE-2026-105317 · affected 3.1.1 and older · fixed in 3.1.2 · published 2026-10-06
high 8.5 WP2LEADS

SQL injection

CVE-2026-25434 · affected 3.5.7 and older · fixed in 3.5.12 * · published 2026-10-06
high 8.5 WP BASE Booking of Appointments, Services and…

SQL injection

CVE-2026-103066 · affected 6.4.0 and older · fixed in 6.5.0 · published 2026-10-05
critical 9.3 WP BASE Booking of Appointments, Services and…

SQL injection

CVE-2026-103352 · affected 6.4.0 and older · fixed in 6.5.0 · published 2026-10-05
high 7.6 Groundhogg

SQL injection

CVE-2026-104408 · affected 4.8.3 and older · fixed in 4.9 · published 2026-10-05
high 8.5 Image Optimizer, Resizer and CDN

SQL injection

CVE-2026-104389 · affected 8.2.5 and older · fixed in 8.2.6 · published 2026-10-05
critical 9.3 Unlimited Elements for Elementor

SQL injection

CVE-2026-103355 · affected 2.0.20 and older · fixed in 2.0.21 · published 2026-10-04
high 7.5 WP Visitor Statistics (Real Time Traffic)

SQL injection

CVE-2026-96267 · affected 8.7 and older · fixed in 8.7.1 * · published 2026-10-03

Other types

Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service · Content injection

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan