cve.bz

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection), page 43

Filter

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

What the weakness is: CWE-89 at MITRE

Ask an AI about CWE-89

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-89: Improper Neutralization of Special Elements used in an SQL Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/89.html and https://cve.bz/cve/cwe/89?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.3CVE-2026-54811EPSS 0.3%

    Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.

  2. 9.3CVE-2026-54187EPSS 0.3%

    Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.

  3. 9.3CVE-2026-54186EPSS 0.3%

    Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.

  4. 8.5CVE-2026-54185EPSS 0.3%

    Subscriber SQL Injection in Cornerstone < 7.8.8 versions.

  5. 9.3CVE-2026-49084EPSS 0.3%

    Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.

  6. 9.3CVE-2026-49080EPSS 0.3%

    Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.

  7. 9.3CVE-2026-49079EPSS 0.3%

    Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

  8. 9.3CVE-2026-49076EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injection.This issue affects JetEngine: from n/a through 3.8.9.1.

  9. 8.5CVE-2026-49073EPSS 0.2%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3.

  10. 8.5CVE-2026-48967EPSS 0.3%

    Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.

  11. 9.3CVE-2026-48875EPSS 0.4%

    Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.

  12. 9.3CVE-2026-39596EPSS 0.4%

    Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.

  13. 9.3CVE-2026-39438EPSS 0.4%

    Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions.

  14. 10.0CVE-2026-28576EPSS 0.2%

    In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploita…

  15. 9.3CVE-2026-22340EPSS 0.4%

    Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions.

  16. 8.5CVE-2026-22335EPSS 0.3%

    Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.

  17. 9.3CVE-2026-22332EPSS 0.3%

    Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.

  18. 7.5CVE-2026-12360EPSS 0.3%

    The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signat…

  19. 8.5CVE-2025-69135EPSS 0.3%

    Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.

  20. 9.3CVE-2026-52715ExploitEPSS 1.2%

    Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.

  21. 7.6CVE-2026-52712EPSS 0.2%

    Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.

  22. 9.3CVE-2026-49772ExploitEPSS 1.9%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16…

  23. 8.5CVE-2026-39581EPSS 0.3%

    Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.

  24. 9.3CVE-2026-39574EPSS 0.2%

    Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.

  25. 8.8CVE-2026-8444EPSS 0.3%

    The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselr…

  26. 8.8CVE-2026-8443EPSS 0.3%

    The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of s…

  27. 8.5CVE-2026-52700EPSS 0.4%

    Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.

  28. 8.5CVE-2026-52697EPSS 0.4%

    Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

  29. 9.3CVE-2026-52693EPSS 0.3%

    Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.

  30. 9.3CVE-2026-49776EPSS 0.3%

    Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.

  31. 9.3CVE-2026-49067EPSS 0.3%

    Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.

  32. 8.5CVE-2026-48964EPSS 0.3%

    Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions.

  33. 9.3CVE-2026-48886EPSS 0.3%

    Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.

  34. 8.5CVE-2026-48882EPSS 0.3%

    Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions.

  35. 8.5CVE-2026-48874EPSS 0.3%

    Subscriber SQL Injection in GamiPress <= 7.8.7 versions.

  36. 9.3CVE-2026-45439EPSS 0.3%

    Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.

  37. 9.3CVE-2026-42665EPSS 0.3%

    Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.

  38. 9.3CVE-2026-42639EPSS 0.3%

    Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.

  39. 9.3CVE-2026-42386EPSS 0.3%

    Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.

  40. 9.3CVE-2026-42381EPSS 0.3%

    Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.

  41. 9.3CVE-2026-40798EPSS 0.3%

    Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.

  42. 9.3CVE-2026-40771EPSS 0.3%

    Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.

  43. 8.5CVE-2026-40766EPSS 0.3%

    Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.

  44. 7.5CVE-2026-40762EPSS 0.3%

    Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.

  45. 9.3CVE-2026-39530EPSS 0.3%

    Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.

  46. 9.3CVE-2026-39519EPSS 0.3%

    Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.

  47. 9.3CVE-2026-39512EPSS 0.3%

    Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.

  48. 9.3CVE-2026-39511EPSS 0.3%

    Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.

  49. 9.3CVE-2026-39502EPSS 0.3%

    Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.

  50. 9.3CVE-2026-39493EPSS 0.4%

    Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.