CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,988 vulnerabilities with CWE-89
CVE-2026-59550 CRITICAL
WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability
CVSS 9.3
CVE-2026-59549 CRITICAL
WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
CVSS 9.3
CVE-2026-59538 CRITICAL
WordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability
CVSS 9.3
CVE-2026-59537 HIGH
WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability
CVSS 7.6
CVE-2026-59533 CRITICAL
WordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability
CVSS 9.3
CVE-2026-59527 CRITICAL
WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
CVSS 9.3
CVE-2026-65877 HIGH
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1
CVE-2026-65876 CRITICAL
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1
CVE-2026-65766 CRITICAL
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1
CVE-2026-14189 LOW
WPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields
CVSS 3.8
CVE-2026-65707 MEDIUM
Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint
CVSS 6.5
CVE-2026-15663 MEDIUM
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
CVSS 4.9
CVE-2026-16765 HIGH
CodeAstro Online Classroom loginlinkadmin.php sql injection
CVSS 7.3
CVE-2026-63359 CRITICAL
Appriss Insights VINE SQLI
CVSS 9.8
CVE-2026-65761 CRITICAL
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1
CVE-2026-65532 HIGH
WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability
CVSS 7.6
CVE-2026-65526 HIGH
WordPress Visualizer plugin <= 4.0.6 - SQL Injection vulnerability
CVSS 8.5
CVE-2026-65494 HIGH
WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability
CVSS 7.1
CVE-2026-65462 HIGH
WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability
CVSS 7.6
CVE-2026-65454 HIGH
WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability
CVSS 8.5
CVE-2026-65451 HIGH
WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
CVSS 8.5
CVE-2026-65450 HIGH
WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
CVSS 8.5
CVE-2026-61950 CRITICAL
WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability
CVSS 9.3
CVE-2026-61949 CRITICAL
WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability
CVSS 9.3
CVE-2026-61948 CRITICAL
WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability
CVSS 9.3
Details
Vulnerabilities 19,988
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits