CVE-2026-96826

HIGHCVSS 7.6

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6.

Timeline

Published:September 23rd, 2026 8:17 PM

Last modified:September 24th, 2026 3:00 PM

CVSS Scoring

CVSS v3: 7.6 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Weaknesses (CWE)

CWE-89

References & Reports

Advisories, patches, and third-party reports

https://patchstack.com/database/wordpress/plugin/w4-post-list/vulnerability/wordpress-w4-post-list-plugin-3-0-6-sql-injection-vulnerability?_s_id=cve

Source: NIST NVD · Data may lag official sources by up to one minute