CVE-2016-10917

CRITICAL

search_everything < 8.1.6 - SQL Injection via Empty Search String

Title source: llm

Description

The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.

References (1)

Core 1

Core References

Release Notes x_refsource_misc

https://wordpress.org/plugins/search-everything/#developers

Scores

CVSS v3 9.8

EPSS 0.0187

EPSS Percentile 77.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

search_everything_project/search_everything < 8.1.6

Published Aug 22, 2019

Tracked Since Feb 18, 2026