CVE-2026-14554

6.5 mediumEPSS 1.4%

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-07-31
Modified: 2026-08-26
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/7b39bae3-41a2-4862-b7c3-1a386273d600/

Check your stack JSON